netssupport.com
Open in
urlscan Pro
185.27.134.33
Malicious Activity!
Public Scan
Effective URL: http://netssupport.com/?i=1
Submission: On September 20 via manual from KE — Scanned from GB
Summary
This is the only time netssupport.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: BankID (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 3 | 185.27.134.33 185.27.134.33 | 34119 (WILDCARD-...) (WILDCARD-AS Wildcard UK Limited) | |
| 3 | 2 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 3 |
netssupport.com
netssupport.com |
46 KB |
| 0 |
Failed
function sub() { [native code] }. Failed |
|
| 3 | 2 |
| Domain | Requested by | |
|---|---|---|
| 3 | netssupport.com |
netssupport.com
|
| 0 | truncated Failed |
netssupport.com
|
| 3 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.bankid.no |
| Subject Issuer | Validity | Valid |
|---|
This page contains 1 frames:
Primary Page:
http://netssupport.com/?i=1
Frame ID: 6328DC91607A9D6419BB3A7E199EC49B
Requests: 6 HTTP requests in this frame
Screenshot
Page Title
BankIDPage URL History Show full URLs
- http://netssupport.com/ Page URL
- http://netssupport.com/?i=1 Page URL
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Personvernerklæring for BankID
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://netssupport.com/ Page URL
- http://netssupport.com/?i=1 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
3 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
/
netssupport.com/ |
826 B 822 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
aes.js
netssupport.com/ |
30 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Primary Request
/
netssupport.com/ |
52 KB 15 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
truncated
/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- truncated
- URL
- data:truncated
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: BankID (Banking)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| netssupport.com/ | Name: __test Value: cdff621bd3be9f617ebe7f3305cbdf58 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
netssupport.com
truncated
truncated
185.27.134.33
3cc3a935838d7a548560831f6bd40597f0106a03ed9e5cad74c6f2ee7709d376
484e8282229f40d3e277f96ca4584b7d6c863f4270f5294bc52c365f5e6473fc
a18497f75dbf5be362a31cba82c06e0dc37f7ed0df98967330b560eb2b063a89
ad28eb57656ccbdd35d05bf85596e9c522a9cd323cecc6dd74962db265274e4a
d2701c86a2a31a641520e72121749dbbabeed4b1a59aece20bbf14f9c9de82bc