urlscan.io logo urlscan.io
SecurityTrails logo

udbetaling.com Open in urlscan Pro
80.249.146.179  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://udbetaling.com/
Effective URL: https://udbetaling.com/
Submission: On September 26 via manual from DK — Scanned from DK
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 4 countries across 5 domains to perform 9 HTTP transactions. The main IP is 80.249.146.179, located in St Petersburg, Russian Federation and belongs to SELECTEL, RU. The main domain is udbetaling.com.
TLS certificate: Issued by R10 on September 18th 2024. Valid for: 3 months.
This is the only time udbetaling.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DK Government (Government)

Domain & IP information

IP Address AS Autonomous System
1 6 80.249.146.179 49505 (SELECTEL)
1 1 2400:52e0:1e0... 60068 (CDN77 _)
1 3 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 104.26.12.205 13335 (CLOUDFLAR...)
9 5
6    80.249.146.179 (St Petersburg, Russian Federation)

ASN49505 (SELECTEL, RU)
udbetaling.com
1    2400:52e0:1e00::874:1 (Germany)

ASN60068 (CDN77 _, GB)
cdn.materialdesignicons.com
3    2606:4700::6812:bb1f (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.jsdelivr.net
1    2606:4700::6812:acf (United States)

ASN13335 (CLOUDFLARENET, US)
stackpath.bootstrapcdn.com
1    104.26.12.205 (None, )

ASN13335 (CLOUDFLARENET, US)
api.ipify.org
Apex Domain
Subdomains		 Transfer
6 udbetaling.com
udbetaling.com
840 KB
3 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 341
332 KB
1 ipify.org
api.ipify.org — Cisco Umbrella Rank: 2176
157 B
1 bootstrapcdn.com
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 3512
29 KB
1 materialdesignicons.com
cdn.materialdesignicons.com — Cisco Umbrella Rank: 49960
724 B
9 5
Domain Requested by
6 udbetaling.com 1 redirects udbetaling.com
3 cdn.jsdelivr.net 1 redirects udbetaling.com
cdn.jsdelivr.net
1 api.ipify.org udbetaling.com
1 stackpath.bootstrapcdn.com udbetaling.com
1 cdn.materialdesignicons.com 1 redirects
9 5

This site contains links to these domains. Also see Links.

Domain
www.nemlog-in.dk
nemlog-in.mitid.dk
www.mitid-erhverv.dk
www.was.digst.dk
Subject Issuer Validity Valid
webmail.udbetaling.com
R10		 2024-09-18 -
2024-12-17		 3 months crt.sh
bootstrapcdn.com
WE1		 2024-09-20 -
2024-12-19		 3 months crt.sh
*.jsdelivr.net
Sectigo RSA Domain Validation Secure Server CA		 2024-05-04 -
2025-05-04		 a year crt.sh
ipify.org
WE1		 2024-09-15 -
2024-12-14		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://udbetaling.com/
Frame ID: C854A439EEB175D65CA0064C90052FBB
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Borgerportalen

Page URL History Show full URLs

  1. http://udbetaling.com/ HTTP 307
    https://udbetaling.com/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • //cdn\.jsdelivr\.net/

Page Statistics

9
Requests

78 %
HTTPS

60 %
IPv6

5
Domains

5
Subdomains

5
IPs

4
Countries

1200 kB
Transfer

1534 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://udbetaling.com/ HTTP 307
    https://udbetaling.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://cdn.materialdesignicons.com/5.4.55/css/materialdesignicons.min.css HTTP 301
  • https://cdn.jsdelivr.net/mdi/5.4.55/css/materialdesignicons.min.css HTTP 301
  • https://cdn.jsdelivr.net/npm/@mdi/font@5.4.55/css/materialdesignicons.min.css
Request Chain 4
  • https://udbetaling.com/bundles/styles?v=CZugzT4a3wY0CIuD0eIXL53_yzvsLILLx6HcfaY8-XQ1 HTTP 302
  • https://udbetaling.com/index.html?v=CZugzT4a3wY0CIuD0eIXL53_yzvsLILLx6HcfaY8-XQ1

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
udbetaling.com/
Redirect Chain
  • http://udbetaling.com/
  • https://udbetaling.com/
769 B
978 B 		Document
General
Check archive.org
Download Go to
Full URL
https://udbetaling.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
80.249.146.179 St Petersburg, Russian Federation, ASN49505 (SELECTEL, RU),
Reverse DNS
Software
nginx /
Resource Hash
460aef530ddc3821051a9048c8fe88091614b0ff5b8aa8582eeeab563d5afe5a

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Length
769
Content-Type
text/html
Date
Thu, 26 Sep 2024 09:22:51 GMT
Last-Modified
Thu, 05 Sep 2024 02:10:16 GMT
Server
nginx

Redirect headers

Location
https://udbetaling.com/
Non-Authoritative-Reason
HttpsUpgrades
materialdesignicons.min.css
cdn.jsdelivr.net/npm/@mdi/font@5.4.55/css/
Redirect Chain
  • https://cdn.materialdesignicons.com/5.4.55/css/materialdesignicons.min.css
  • https://cdn.jsdelivr.net/mdi/5.4.55/css/materialdesignicons.min.css
  • https://cdn.jsdelivr.net/npm/@mdi/font@5.4.55/css/materialdesignicons.min.css
245 KB
40 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/@mdi/font@5.4.55/css/materialdesignicons.min.css
Requested by
Host: udbetaling.com
URL: https://udbetaling.com/
Protocol
H2
Server
2606:4700::6812:bb1f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
aee3527737949377d842c8d715b99b98b0e31c2528aa49809cb9555dd8908cc8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://udbetaling.com/

Response headers

access-control-expose-headers
*
content-encoding
gzip
cf-cache-status
HIT
etag
W/"3d236-+1GUFQQB1xbFJxuoLlvWA9Vm3l0"
age
12340958
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AxXJsitymyJD%2BScFbXCeMJi9Mf%2FqxT3bxanqmp6JXLxgqEx1v43CcLLTHQsXW5Kw1SGl%2BccIRCHpPT7FCm0yChB%2F1ddAdirraM9KOwD%2FFmS1npccasWiv8tjySaCjalGDoGmRkgIIYm3eSiihjg%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
x-jsd-version-type
version
x-cache
HIT, HIT
date
Thu, 26 Sep 2024 09:22:52 GMT
content-type
text/css; charset=utf-8
x-served-by
cache-fra-eddf8230058-FRA, cache-lga21947-LGA
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
8c923124594dcac9-HAM
accept-ranges
bytes
access-control-allow-origin
*
content-length
40876
server
cloudflare
x-jsd-version
5.4.55

Redirect headers

access-control-expose-headers
*
cf-cache-status
HIT
age
12340958
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tYUbhV2v3LjdM7Nj639TS%2FQACVaK5E7Pm%2FtGfAxW1XKkRBGEwfV3lO6Xbt%2BYjTgVy%2B2Dg7OTFUpc79SMHj3L9knDtDT%2FuidoxnUWLthtl06UoFDbp89i75Zkslyxwo9MsVnCnEjEJ7FmcEyljIA%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
x-cache
HIT, HIT
date
Thu, 26 Sep 2024 09:22:52 GMT
content-type
text/plain; charset=utf-8
x-served-by
cache-fra-eddf8230116-FRA, cache-lga21952-LGA
vary
Accept-Encoding, Accept
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=31536000
location
https://cdn.jsdelivr.net/npm/@mdi/font@5.4.55/css/materialdesignicons.min.css
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
8c923123f8e0cac9-HAM
access-control-allow-origin
*
content-length
111
server
cloudflare
main.c83a145a.js
udbetaling.com/static/js/ 		542 KB
542 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://udbetaling.com/static/js/main.c83a145a.js
Requested by
Host: udbetaling.com
URL: https://udbetaling.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
80.249.146.179 St Petersburg, Russian Federation, ASN49505 (SELECTEL, RU),
Reverse DNS
Software
nginx /
Resource Hash
0d6632a0902cb42dacaf1e6613e8ec228e3294de2329ac7067a07f938345bf4d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://udbetaling.com/

Response headers

Accept-Ranges
bytes
Content-Length
555289
Date
Thu, 26 Sep 2024 09:22:51 GMT
Content-Type
text/javascript
Last-Modified
Wed, 18 Sep 2024 15:06:39 GMT
Server
nginx
Connection
keep-alive
main.ef74f425.css
udbetaling.com/static/css/ 		291 KB
291 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://udbetaling.com/static/css/main.ef74f425.css
Requested by
Host: udbetaling.com
URL: https://udbetaling.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
80.249.146.179 St Petersburg, Russian Federation, ASN49505 (SELECTEL, RU),
Reverse DNS
Software
nginx /
Resource Hash
b1cd0a6a4e5f8f9c195d3c5cb8ebaa1ef02f5e7e4edc57bb6f0da06e4c39ca5c

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://udbetaling.com/

Response headers

Accept-Ranges
bytes
Content-Length
298091
Date
Thu, 26 Sep 2024 09:22:52 GMT
Content-Type
text/css
Last-Modified
Wed, 04 Sep 2024 00:34:42 GMT
Server
nginx
Connection
keep-alive
bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/ 		157 KB
29 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css
Requested by
Host: udbetaling.com
URL: https://udbetaling.com/static/css/main.ef74f425.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://udbetaling.com/

Response headers

cdn-status
200
content-encoding
gzip
cf-cache-status
HIT
etag
W/"816af0eddd3b4822c2756227c7e7b7ee"
age
12748515
x-content-type-options
nosniff
date
Thu, 26 Sep 2024 09:22:52 GMT
last-modified
Mon, 25 Jan 2021 22:04:11 GMT
content-type
text/css; charset=utf-8
vary
Accept-Encoding
cdn-cache
HIT
cdn-cachedat
07/07/2023 01:23:40
cdn-requestpullcode
200
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=31919000
cdn-requestpullsuccess
True
timing-allow-origin
*
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
11f873f6646fa46b819bbd06b011b0c8
cross-origin-resource-policy
cross-origin
cdn-pullzone
252412
cdn-proxyver
1.03
cf-ray
8c923125dc2a7510-HAM
access-control-allow-origin
*
cdn-edgestorageid
1055
server
cloudflare
cdn-requestcountrycode
DE
index.html
udbetaling.com/
Redirect Chain
  • https://udbetaling.com/bundles/styles?v=CZugzT4a3wY0CIuD0eIXL53_yzvsLILLx6HcfaY8-XQ1
  • https://udbetaling.com/index.html?v=CZugzT4a3wY0CIuD0eIXL53_yzvsLILLx6HcfaY8-XQ1
769 B
978 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://udbetaling.com/index.html?v=CZugzT4a3wY0CIuD0eIXL53_yzvsLILLx6HcfaY8-XQ1
Protocol
HTTP/1.1
Server
80.249.146.179 St Petersburg, Russian Federation, ASN49505 (SELECTEL, RU),
Reverse DNS
Software
nginx /
Resource Hash
460aef530ddc3821051a9048c8fe88091614b0ff5b8aa8582eeeab563d5afe5a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://udbetaling.com/

Response headers

Accept-Ranges
bytes
Content-Length
769
Date
Thu, 26 Sep 2024 09:22:52 GMT
Content-Type
text/html
Last-Modified
Thu, 05 Sep 2024 02:10:16 GMT
Server
nginx
Connection
keep-alive

Redirect headers

Location
https://udbetaling.com/index.html?v=CZugzT4a3wY0CIuD0eIXL53_yzvsLILLx6HcfaY8-XQ1
Content-Length
264
Date
Thu, 26 Sep 2024 09:22:52 GMT
Content-Type
text/html; charset=iso-8859-1
Server
nginx
Connection
keep-alive
materialdesignicons-webfont.woff2
cdn.jsdelivr.net/npm/@mdi/font@5.4.55/fonts/ 		290 KB
291 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/@mdi/font@5.4.55/fonts/materialdesignicons-webfont.woff2?v=5.4.55
Requested by
Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/@mdi/font@5.4.55/css/materialdesignicons.min.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:bb1f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
91304a14ef55cc410b34f9f01399f6d1c695accceda7f68d4a221e38c53fd2ae
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin
https://udbetaling.com
Referer
https://cdn.jsdelivr.net/npm/@mdi/font@5.4.55/css/materialdesignicons.min.css

Response headers

access-control-expose-headers
*
cf-cache-status
HIT
etag
W/"486f0-QcsB0Bhq1tHa7BEMo7sPZ2bkGdM"
age
540641
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jzqHmX7%2BtvnCB9VB8NKg7%2FhP6YmOUL%2B6hhHOjcEp%2FJMkMiyOB3gvmd7xOxuEWYVUDZnMCaAcJvayhblX9PCFlsq25Tbd6lbLOvF3fJMM9mUcF72QLVK9mRyPbdmhP7mLiSMz7ftmSwcXD3I39oM%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
x-jsd-version-type
version
alt-svc
h3=":443"; ma=86400
x-cache
HIT, HIT
date
Thu, 26 Sep 2024 09:22:52 GMT
content-type
font/woff2
x-served-by
cache-fra-eddf8230113-FRA, cache-lga21945-LGA
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
8c9231274f514168-HAM
accept-ranges
bytes
access-control-allow-origin
*
content-length
296688
server
cloudflare
x-jsd-version
5.4.55
truncated
/ 		93 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d8c43664dcfb8d312acb454f286831febe319a051b0b29d79fb7606da173fbe6

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
truncated
/ 		5 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
df9f7432ac851bd6cb48f3722a4637df7a018923d6188e19428d31c194937fe1

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
/
api.ipify.org/ 		24 B
157 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.ipify.org/?format=json
Requested by
Host: udbetaling.com
URL: https://udbetaling.com/static/js/main.c83a145a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.12.205 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5212f2ddf4304fd2c5cd5fdada01732f1a0604cfc7f0153ff4e9082e6d6d72bb

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept
application/json, text/plain, */*
Referer
https://udbetaling.com/

Response headers

cf-cache-status
DYNAMIC
cf-ray
8c9231276ca26648-AMS
access-control-allow-origin
*
content-length
24
date
Thu, 26 Sep 2024 09:22:52 GMT
content-type
application/json
vary
Origin
server
cloudflare
favicon.ico
udbetaling.com/ 		4 KB
4 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://udbetaling.com/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
80.249.146.179 St Petersburg, Russian Federation, ASN49505 (SELECTEL, RU),
Reverse DNS
Software
nginx /
Resource Hash
3d10f7da6c603178340081668c4ac5b3ae9743ca9a262ab0fcd312fbb9f48bdd

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://udbetaling.com/

Response headers

Accept-Ranges
bytes
Content-Length
3870
Date
Thu, 26 Sep 2024 09:22:52 GMT
Content-Type
image/x-icon
Last-Modified
Wed, 04 Sep 2024 00:34:42 GMT
Server
nginx
Connection
keep-alive

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DK Government (Government)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| webpackChunkborger2

0 Cookies