bnkidnordopp.wpenginepowered.com Open in urlscan Pro
141.193.213.11 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://link.casepariurilor.com/ga/click/2-468152-6-175-348-302-44382834fa-61a8fe7ee6
Effective URL:
https://bnkidnordopp.wpenginepowered.com/vippsend/
Submission: On November 27 via api (November 27th 2024, 7:42:03 pm UTC) from PL — Scanned from NO

Summary HTTP 5 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 5 domains to perform 5 HTTP transactions. The main IP is 141.193.213.11, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare London, LLC, US. The main domain is bnkidnordopp.wpenginepowered.com.
TLS certificate: Issued by E6 on November 16th 2024. Valid for: 3 months.

This is the only time bnkidnordopp.wpenginepowered.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Vipps (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	188.114.97.3 188.114.97.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	2600:1901:0:5... 2600:1901:0:56f6::	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	141.193.213.11 141.193.213.11	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare London)
5	2

1 188.114.97.3 (Amsterdam, Netherlands) 1 redirects

ASN13335 (CLOUDFLARENET, US)

link.casepariurilor.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1901:0:56f6:: (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)

gtly.to	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 141.193.213.11 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US)

bnkidnordopp.wpenginepowered.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	wpenginepowered.com bnkidnordopp.wpenginepowered.com	808 KB
1	gtly.to 1 redirects gtly.to — Cisco Umbrella Rank: 519497	444 B
1	casepariurilor.com 1 redirects link.casepariurilor.com	875 B
0	gstatic.com Failed www.gstatic.com Failed
0	Failed function sub() { [native code] }. Failed
5	5

	Domain	Requested by
1	bnkidnordopp.wpenginepowered.com
1	gtly.to	1 redirects
1	link.casepariurilor.com	1 redirects
0	www.gstatic.com Failed	bnkidnordopp.wpenginepowered.com
0	invalid Failed	bnkidnordopp.wpenginepowered.com
5	5

This site contains no links.

Subject Issuer	Validity	Valid
wpenginepowered.com E6	`2024-11-16` - `2025-02-14`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://bnkidnordopp.wpenginepowered.com/vippsend/
Frame ID: 5EA4B4C3F08801B226760A1A562AC96B
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Logg inn på bedriftsportalen | Bedriftsportal

Page URL History Show full URLs

https://link.casepariurilor.com/ga/click/2-468152-6-175-348-302-44382834fa-61a8fe7ee6 HTTP 302
https://gtly.to/yIIsAUcYe1 HTTP 301
https://bnkidnordopp.wpenginepowered.com/vippsend/ Page URL

Page Statistics

5
Requests

20 %
HTTPS

33 %
IPv6

5
Domains

5
Subdomains

2
IPs

2
Countries

944 kB
Transfer

1319 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://link.casepariurilor.com/ga/click/2-468152-6-175-348-302-44382834fa-61a8fe7ee6 HTTP 302
https://gtly.to/yIIsAUcYe1 HTTP 301
https://bnkidnordopp.wpenginepowered.com/vippsend/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
5 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H3	200	Primary Request / Show response bnkidnordopp.wpenginepowered.com/vippsend/ Redirect Chain https://link.casepariurilor.com/ga/click/2-468152-6-175-348-302-44382834fa-61a8fe7ee6 https://gtly.to/yIIsAUcYe1 https://bnkidnordopp.wpenginepowered.com/vippsend/	1 MB 808 KB	1077ms 1011ms	Document text/html	141.193.213.11 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://bnkidnordopp.wpenginepowered.com/vippsend/ Protocol H3 Security QUIC, , AES_128_GCM Server 141.193.213.11 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US), Reverse DNS Software cloudflare / WP Engine Resource Hash `94ab7d2487ce4dbae4a22601b369e269d697888e8b907d9f0ffbb4bd4b9294bf` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Response headers alt-svc h3=":443"; ma=86400 cache-control max-age=600, must-revalidate cf-cache-status DYNAMIC cf-ray 8e9499373e6d1600-ARN content-encoding br content-type text/html; charset=UTF-8 date Wed, 27 Nov 2024 19:41:56 GMT server cloudflare vary Accept-Encoding Accept-Encoding Accept-Encoding Accept-Encoding,Cookie x-cache HIT: 3 x-cache-group iphone x-cacheable SHORT x-powered-by WP Engine Redirect headers alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control private, no-cache, no-store, must-revalidate content-length 156 content-type text/html; charset=utf-8 date Wed, 27 Nov 2024 19:41:55 GMT location https://bnkidnordopp.wpenginepowered.com/vippsend/ referer server Google Frontend vary Accept via 1.1 google x-cloud-trace-context 7d81c1664080b407cd7bd9cdd1a78af3 x-powered-by Express
GET		/ invalid/	0 0

GET		m=el_main_css www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.26tY-h6gH9w.L.W.O/am=DgY/d=0/rs=AN8SPfowAA8SIQKHJetkAleDuiUL98-5fQ/	0 0

GET		/ invalid/	0 0

GET		/ invalid/	0 0

GET DATA	200 OK	truncated /	805 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a5b0c459ca2b4a87efe9e5aec20177ce508ce30f78fd67b907df63c43b143630` Request headers User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Referer Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	16 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `f99d080e389895d8d46238db520cc0a5fb51b2c18e213f7d59a784a94e25ed9c` Request headers User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Referer Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	37 KB 37 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `9b57dcdf0fcc8b9bb3918ae65e724c73a9fd9d669edf5350ec0290a0a162c837` Request headers User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Origin https://bnkidnordopp.wpenginepowered.com Referer Response headers Content-Type font/woff2
GET DATA	200 OK	truncated /	50 KB 50 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `3a86a0f6b16b24d9e454f184a87f0775b45cfae8f5d1666d4135dc9c64779608` Request headers User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Origin https://bnkidnordopp.wpenginepowered.com Referer Response headers Content-Type font/woff2
GET DATA	200 OK	truncated /	49 KB 49 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `dca382997026cc4baee019e2f365e254268448670a6e9222557b76f09c9f8a2a` Request headers User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Origin https://bnkidnordopp.wpenginepowered.com Referer Response headers Content-Type font/woff2

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: invalid
URL: chrome-extension://invalid/

Domain: www.gstatic.com
URL: https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.26tY-h6gH9w.L.W.O/am=DgY/d=0/rs=AN8SPfowAA8SIQKHJetkAleDuiUL98-5fQ/m=el_main_css

Domain: invalid
URL: chrome-extension://invalid/

Domain: invalid
URL: chrome-extension://invalid/

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Vipps (Banking)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| limitToElevenDigits function| validateExactElevenDigits

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: chrome-extension://invalid/ Message: Failed to load resource: net::ERR_BLOCKED_BY_CLIENT
security	error	URL: https://bnkidnordopp.wpenginepowered.com/vippsend/(Line 14) Message: Refused to load the stylesheet 'https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.26tY-h6gH9w.L.W.O/am=DgY/d=0/rs=AN8SPfowAA8SIQKHJetkAleDuiUL98-5fQ/m=el_main_css' because it violates the following Content Security Policy directive: "style-src 'unsafe-inline'". Note that 'style-src-elem' was not explicitly set, so 'style-src' is used as a fallback.
network	error	URL: chrome-extension://invalid/ Message: Failed to load resource: net::ERR_BLOCKED_BY_CLIENT
network	error	URL: chrome-extension://invalid/ Message: Failed to load resource: net::ERR_BLOCKED_BY_CLIENT

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bnkidnordopp.wpenginepowered.com
gtly.to
invalid
link.casepariurilor.com
www.gstatic.com
invalid
www.gstatic.com
141.193.213.11
188.114.97.3
2600:1901:0:56f6::
3a86a0f6b16b24d9e454f184a87f0775b45cfae8f5d1666d4135dc9c64779608
94ab7d2487ce4dbae4a22601b369e269d697888e8b907d9f0ffbb4bd4b9294bf
9b57dcdf0fcc8b9bb3918ae65e724c73a9fd9d669edf5350ec0290a0a162c837
a5b0c459ca2b4a87efe9e5aec20177ce508ce30f78fd67b907df63c43b143630
dca382997026cc4baee019e2f365e254268448670a6e9222557b76f09c9f8a2a
f99d080e389895d8d46238db520cc0a5fb51b2c18e213f7d59a784a94e25ed9c

bnkidnordopp.wpenginepowered.com Open in urlscan Pro 141.193.213.11 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

5 Requests

20 %HTTPS

33 %IPv6

5 Domains

5 Subdomains

2 IPs

2 Countries

944 kBTransfer

1319 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

4 Console Messages

Indicators

bnkidnordopp.wpenginepowered.com Open in urlscan Pro
141.193.213.11 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

20 %
HTTPS

33 %
IPv6

5
Domains

5
Subdomains

2
IPs

2
Countries

944 kB
Transfer

1319 kB
Size

0
Cookies

5 HTTP transactions
5 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!