urlscan.io logo urlscan.io
SecurityTrails logo

seb.mobilsakerhet.com Open in urlscan Pro
172.67.129.101  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://seb.mobilsakerhet.com/uppdatering/
Submission: On June 16 via manual from SE — Scanned from SE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 9 HTTP transactions. The main IP is 172.67.129.101, located in United States and belongs to CLOUDFLARENET, US. The main domain is seb.mobilsakerhet.com.
This is the only time seb.mobilsakerhet.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: SEB Group (Banking)

Domain & IP information

IP Address AS Autonomous System
5 172.67.129.101 13335 (CLOUDFLAR...)
1 129.178.73.10 44320 (SEBNET-AS)
9 3
Apex Domain
Subdomains		 Transfer
5 mobilsakerhet.com
seb.mobilsakerhet.com
241 KB
1 seb.se
id.seb.se
258 KB
9 2
Domain Requested by
5 seb.mobilsakerhet.com seb.mobilsakerhet.com
1 id.seb.se seb.mobilsakerhet.com
9 2

This site contains no links.

Subject Issuer Validity Valid
mobilsakerhet.com
E1		 2023-06-09 -
2023-09-07		 3 months crt.sh
id.seb.se
DigiCert EV RSA CA G2		 2023-04-19 -
2024-04-18		 a year crt.sh

This page contains 1 frames:

Primary Page: http://seb.mobilsakerhet.com/uppdatering/
Frame ID: 7140AF6D9E774AE108985A2C01C0B2C7
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Förnya Mobilt BankID | SEB

Detected technologies

Overall confidence: 100%
Detected patterns

Page Statistics

9
Requests

33 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

499 kB
Transfer

665 kB
Size

3
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
seb.mobilsakerhet.com/uppdatering/ 		5 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://seb.mobilsakerhet.com/uppdatering/
Protocol
HTTP/1.1
Server
172.67.129.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2279b57be741505fb6e2ef389c71f491e1fd98942c6c39c427efb624ee9b8a0b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
se-SE,se;q=0.9

Response headers

CF-Cache-Status
DYNAMIC
CF-RAY
7d82729558f21c8f-AMS
Cache-Control
no-cache, private
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Fri, 16 Jun 2023 10:42:42 GMT
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EAOWgvm3guJIOb6ohnrMCazqX%2BHQ3t2edX8%2FrmspXCJ5IpNgiwfYz18x%2FwKd%2FTtIAblEdHUM7gGwDBOTCQ6PV3CjGep52elULxNqeR3ELqfNBzpqdOGIV%2Fg1TgxpqNIZsen4wfZ%2FlCY%3D"}],"group":"cf-nel","max_age":604800}
Server
cloudflare
Transfer-Encoding
chunked
Vary
Accept-Encoding
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-XSS-Protection
1; mode=block
alt-svc
h3=":443"; ma=86400
app.css
seb.mobilsakerhet.com/css/seb/ 		12 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://seb.mobilsakerhet.com/css/seb/app.css?id=63b807b31a58fd46ae1096e56098dd33
Requested by
Host: seb.mobilsakerhet.com
URL: http://seb.mobilsakerhet.com/uppdatering/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.129.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8cb192542b4fbc6b348f0c5a175c3a43203cc18c883ac553c442cbd5e2226951
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
se-SE,se;q=0.9
Referer
http://seb.mobilsakerhet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 16 Jun 2023 10:42:42 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Tue, 11 Apr 2023 14:20:58 GMT
server
cloudflare
etag
W/"64356cca-2f03"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QGjSNf6qtWCjmDOxRjnS%2BqCQf0xBcyOZ4ZsM4ih5Si0la1Cz5J03f6%2FMvfbdZrbaF2seG1o9Rsux7n9orwEtwv7DM95cDIkvCjCIxBHINJjpGTo4RFY3xDhQ%2FkdQN8FHtD1qXwGC3EI%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=14400
cf-ray
7d827296cef2d973-HEL
bankid.svg
seb.mobilsakerhet.com/images/ 		3 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://seb.mobilsakerhet.com/images/bankid.svg
Requested by
Host: seb.mobilsakerhet.com
URL: http://seb.mobilsakerhet.com/uppdatering/
Protocol
HTTP/1.1
Server
172.67.129.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ce22eb0c405b78a4247ec19eba5816e03a01a3c065e84a2bc58a23875cd1efc7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
se-SE,se;q=0.9
Referer
http://seb.mobilsakerhet.com/uppdatering/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Fri, 16 Jun 2023 10:42:42 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
CF-Cache-Status
REVALIDATED
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Transfer-Encoding
chunked
Connection
keep-alive
alt-svc
h3=":443"; ma=86400
X-XSS-Protection
1; mode=block
Last-Modified
Tue, 11 Apr 2023 14:20:58 GMT
Server
cloudflare
ETag
W/"64356cca-cb1"
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Content-Type
image/svg+xml
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7xMxDYXLIJtL0GUnzbqsVjvjrPj0wUg%2FPm0RWR5DwQSOcpmr5980Ah7Pgn%2FyF0AweGZGspZ9eRn4OMcWf1o5HMtCCBuG%2BhgEAqi97gqjG5lGaCAIF9UhZ21JgpF3Ur3GCFVanRuQgNI%3D"}],"group":"cf-nel","max_age":604800}
Cache-Control
max-age=14400
CF-RAY
7d8272965a561c8f-AMS
seb-digipass.png
seb.mobilsakerhet.com/images/seb/ 		163 KB
164 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://seb.mobilsakerhet.com/images/seb/seb-digipass.png
Requested by
Host: seb.mobilsakerhet.com
URL: http://seb.mobilsakerhet.com/uppdatering/
Protocol
HTTP/1.1
Server
172.67.129.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d8ee7bc0ed0e64fcad7894ca984b51f80e422d0e8674d6d35375f925ce6f5176
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
se-SE,se;q=0.9
Referer
http://seb.mobilsakerhet.com/uppdatering/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Fri, 16 Jun 2023 10:42:42 GMT
X-Content-Type-Options
nosniff
CF-Cache-Status
MISS
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Connection
keep-alive
alt-svc
h3=":443"; ma=86400
Content-Length
166919
X-XSS-Protection
1; mode=block
Last-Modified
Tue, 11 Apr 2023 14:20:58 GMT
Server
cloudflare
ETag
"64356cca-28c07"
X-Frame-Options
SAMEORIGIN
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xumUW0jYhQpwA4uub6pd7OI19aO%2Bz2PqPCqHsfmcVFWbGzSHYrzoGjftl6Nx5RY7xnWoYqxj4uQnHmR810gzkliA7m4FSfmHVfzlBm456Xfp%2B6M8xv3NJ%2BZczHFtOiLyskGs1HQexGA%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
image/png
Vary
Accept-Encoding
Cache-Control
max-age=14400
Accept-Ranges
bytes
CF-RAY
7d827296fb361c8f-AMS
app.js
seb.mobilsakerhet.com/js/seb/ 		224 KB
67 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://seb.mobilsakerhet.com/js/seb/app.js?id=f65ead0ff96fe627dbf16ce6c26fbc42
Requested by
Host: seb.mobilsakerhet.com
URL: http://seb.mobilsakerhet.com/uppdatering/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.129.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3163a965c0b3778fd3489661837fa536aee8e649c0ac2dcdc19ccb23112b7176
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
se-SE,se;q=0.9
Referer
http://seb.mobilsakerhet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 16 Jun 2023 10:42:42 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Tue, 23 May 2023 16:44:35 GMT
server
cloudflare
etag
W/"646ced73-380da"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript; charset=utf-8
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GyDeuGkAiTWC%2FGFZzJurzhpYgliMvjktHQ5MtLNbOJJclbO5NwXGqYBY38gD4g2SpYXjTKW1%2F%2F0J6oSctRm7ZU881OaoBczzVVQ3QQY7uhl6uji5DKEGr5oXY51DG5DW5KhMbXOtVQg%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=14400
cf-ray
7d827297a925d973-HEL
fog-and-trees.jpg
id.seb.se/assets/ 		257 KB
258 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://id.seb.se/assets/fog-and-trees.jpg
Requested by
Host: seb.mobilsakerhet.com
URL: https://seb.mobilsakerhet.com/css/seb/app.css?id=63b807b31a58fd46ae1096e56098dd33
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
129.178.73.10 , Sweden, ASN44320 (SEBNET-AS, SE),
Reverse DNS
id.seb.se
Software
/
Resource Hash
557a7d0a1ffc8d177fdb8aaa8e65639f07fecd9833fe04a92968e1cfad72ca5a
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

accept-language
se-SE,se;q=0.9
Referer
https://seb.mobilsakerhet.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Fri, 16 Jun 2023 10:42:42 GMT
Strict-Transport-Security
max-age=15552000; includeSubDomains
Frame-Options
deny
Last-Modified
Wed, 01 Mar 2023 14:15:05 GMT
ETag
"63ff5de9-40509"
Content-Type
image/jpeg
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
263433
SEBSansSerif-Medium.308ab8de3c2e2535.woff2
seb.mobilsakerhet.com/fonts/seb/ 		0
0
SEBSansSerif-Regular.4c7865fb24ae2790.woff2
seb.mobilsakerhet.com/fonts/seb/ 		0
0
SEBSansSerif-Medium.308ab8de3c2e2535.woff
seb.mobilsakerhet.com/fonts/seb/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
seb.mobilsakerhet.com
URL
https://seb.mobilsakerhet.com/fonts/seb/SEBSansSerif-Medium.308ab8de3c2e2535.woff2
Domain
seb.mobilsakerhet.com
URL
https://seb.mobilsakerhet.com/fonts/seb/SEBSansSerif-Regular.4c7865fb24ae2790.woff2
Domain
seb.mobilsakerhet.com
URL
https://seb.mobilsakerhet.com/fonts/seb/SEBSansSerif-Medium.308ab8de3c2e2535.woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: SEB Group (Banking)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend object| customerId object| preOTP1 object| preOTP2 boolean| enableSMS function| axios object| QRCode object| Alpine function| Vue

3 Cookies

Domain/Path Name / Value
seb.mobilsakerhet.com/ Name: XSRF-TOKEN
Value: eyJpdiI6Ii93SnhpU0dXWTZMNWJPejQ1aGFHL2c9PSIsInZhbHVlIjoiZW1TTW5GVWlia2xLVm4rakJ4MGg2aEpOdGFNNU5LcFZpc2QzVi9EN21aeTJGNkxlU2VnSkVOdnBSMnZxRUM4aWJoemsxMmVUZENlRUl5cnZ1bW1BRVl1VmxPK0xYSUtXN3JwVCtXcFFUdWUzdThhdUJwbTQ1RXpDL1lOTGpBbHIiLCJtYWMiOiJlMjU5YjIwMWIzNjIxM2Q3MWM5YjA5MDliZWZmNDMxNTVhZjQ3ZTU5YWI3ZDEwMTc0NGI4YjMwNTVmYzZiZWI2IiwidGFnIjoiIn0%3D
seb.mobilsakerhet.com/ Name: laravel_session
Value: eyJpdiI6IjhWTGZHM21sZUc3U1BvTkh0eXpzaEE9PSIsInZhbHVlIjoiRUFBTlE5YTY3Tm5neGVodzd3NXpxZGMvakdoamRYd3JPL2VXK1RyZnBNbitoUEdONExsT0hGd1p5SGxjOWNkMndDa2F1UklLdi9VR3YvZWhuOTFpQXpQRC9Zd3RHMTBFM2FaSXlPWlBWTGJUMVYxMHEwZnRVQzczVXJyVUtkMm0iLCJtYWMiOiJkODFhMmU4OGE2ZDM3MDkyNmE4MzZlMjg1MTQ3NmM0ZGE0MDVmMTUwMThmODg2ZjgzNzNhZDBiY2Y1ZTU3NmEzIiwidGFnIjoiIn0%3D
id.seb.se/ Name: BIGipServerssi_prd~auth-front_seb-login-client_8080_pool
Value: 1474037514.36895.0000

6 Console Messages

Source Level URL
Text
javascript error URL: http://seb.mobilsakerhet.com/uppdatering/
Message:
Access to font at 'https://seb.mobilsakerhet.com/fonts/seb/SEBSansSerif-Regular.4c7865fb24ae2790.woff2' from origin 'http://seb.mobilsakerhet.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://seb.mobilsakerhet.com/fonts/seb/SEBSansSerif-Regular.4c7865fb24ae2790.woff2
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: http://seb.mobilsakerhet.com/uppdatering/
Message:
Access to font at 'https://seb.mobilsakerhet.com/fonts/seb/SEBSansSerif-Medium.308ab8de3c2e2535.woff2' from origin 'http://seb.mobilsakerhet.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://seb.mobilsakerhet.com/fonts/seb/SEBSansSerif-Medium.308ab8de3c2e2535.woff2
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: http://seb.mobilsakerhet.com/uppdatering/
Message:
Access to font at 'https://seb.mobilsakerhet.com/fonts/seb/SEBSansSerif-Medium.308ab8de3c2e2535.woff' from origin 'http://seb.mobilsakerhet.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://seb.mobilsakerhet.com/fonts/seb/SEBSansSerif-Medium.308ab8de3c2e2535.woff
Message:
Failed to load resource: net::ERR_FAILED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block