applogindanske.hier-im-netz.de Open in urlscan Pro
2003:2:2:15:80:150:6:138 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://applogindanske.hier-im-netz.de/app/fi/
Submission: On May 21 via manual (May 21st 2024, 10:56:56 am UTC) from FI — Scanned from FI

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 9 HTTP transactions. The main IP is 2003:2:2:15:80:150:6:138, located in Germany and belongs to DTAG Internet service provider operations, DE. The main domain is applogindanske.hier-im-netz.de.
TLS certificate: Issued by Telekom Security ServerID OV Class 2 CA on December 11th 2023. Valid for: a year.

This is the only time applogindanske.hier-im-netz.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Danske Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
3	2003:2:2:15:8... 2003:2:2:15:80:150:6:138	3320 (DTAG Inte...) (DTAG Internet service provider operations)
1	212.93.38.8 212.93.38.8	12483 (DANSKEBAN...) (DANSKEBANK-AS Aarhus Denmark)
2	212.93.61.97 212.93.61.97	12483 (DANSKEBAN...) (DANSKEBANK-AS Aarhus Denmark)
9	4

3 2003:2:2:15:80:150:6:138 (Germany)

ASN3320 (DTAG Internet service provider operations, DE)

applogindanske.hier-im-netz.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 212.93.38.8 (Denmark)

ASN12483 (DANSKEBANK-AS Aarhus Denmark, DK)

shared-logon.danskebank.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 212.93.61.97 (Gentofte Municipality, Denmark)

ASN12483 (DANSKEBANK-AS Aarhus Denmark, DK)

danskebank.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	hier-im-netz.de applogindanske.hier-im-netz.de	4 KB
2	danskebank.fi danskebank.fi	5 KB
1	danskebank.com shared-logon.danskebank.com — Cisco Umbrella Rank: 435736	2 KB
9	3

	Domain	Requested by
3	applogindanske.hier-im-netz.de	applogindanske.hier-im-netz.de
2	danskebank.fi	applogindanske.hier-im-netz.de
1	shared-logon.danskebank.com	applogindanske.hier-im-netz.de shared-logon.danskebank.com
9	3

This site contains no links.

Subject Issuer	Validity	Valid
*.hier-im-netz.de Telekom Security ServerID OV Class 2 CA	`2023-12-11` - `2024-12-15`	a year	crt.sh
shared-logon.danskebank.com GlobalSign RSA OV SSL CA 2018	`2024-04-04` - `2025-05-06`	a year	crt.sh
www.danskebank.fi GlobalSign ECC OV SSL CA 2018	`2024-01-23` - `2025-02-23`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://applogindanske.hier-im-netz.de/app/fi/
Frame ID: 29A90692B4F22C675D972A77654EEB89
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Tunnistaudu palveluun: Allekirjoituspalvelu - ID: Y7SX

Page Statistics

9
Requests

67 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

11 kB
Transfer

18 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
applogindanske.hier-im-netz.de/app/fi/ 4 KB
4 KB 318ms
82ms Document
text/html 2003:2:2:15:80:150:6:138
DTAG Internet ser...

General

Check archive.org

Show headers Download Go to

Full URL: https://applogindanske.hier-im-netz.de/app/fi/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2003:2:2:15:80:150:6:138 , Germany, ASN3320 (DTAG Internet service provider operations, DE),
Reverse DNS
Software: CM4all Webserver /
Resource Hash: 1989ffa455347abef138d3b062053584d7c0d052ee80ca2abfd8bfc6a57d66a8

Request headers

Accept-Language: fi-FI,fi;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

content-type: text/html; charset=UTF-8
date: Tue, 21 May 2024 10:56:52 GMT
server: CM4all Webserver

GET
H/1.1 200
OK main.2b901aef.css
shared-logon.danskebank.com/logon/default/static/css/ 5 KB
2 KB 312ms
77ms Stylesheet
text/css 212.93.38.8
DANSKEBANK-AS Aar...

General

Check archive.org

Show headers Download Go to

Full URL

https://shared-logon.danskebank.com/logon/default/static/css/main.2b901aef.css

Requested by

Host: applogindanske.hier-im-netz.de
URL: https://applogindanske.hier-im-netz.de/app/fi/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

212.93.38.8 , Denmark, ASN12483 (DANSKEBANK-AS Aarhus Denmark, DK),

Reverse DNS

Software

Resource Hash

f0228a65851c12b5da774f1ee2d931aa3fd2352914ef6de25c1c9d6dd1426627

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000

Request headers

Accept-Language: fi-FI,fi;q=0.9;q=0.9
Referer: https://applogindanske.hier-im-netz.de/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 May 2024 10:56:53 GMT
content-encoding: gzip
Strict-Transport-Security: max-age=157680000
last-modified: Tue, 09 Apr 2024 12:11:09 GMT
etag: W/"1421-18ec2c4eb48"
vary: Accept-Encoding
transfer-encoding: chunked
content-type: text/css; charset=UTF-8
cache-control: no-cache
accept-ranges: bytes
keep-alive: timeout=5

GET
H2 404 main.2b901aef.css
applogindanske.hier-im-netz.de/app/fi/static/css/ 0
0 76ms
75ms Stylesheet
text/html 2003:2:2:15:80:150:6:138
DTAG Internet ser...

General

Check archive.org

Show headers Download Go to

Full URL: https://applogindanske.hier-im-netz.de/app/fi/static/css/main.2b901aef.css
Requested by: Host: applogindanske.hier-im-netz.de
URL: https://applogindanske.hier-im-netz.de/app/fi/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2003:2:2:15:80:150:6:138 , Germany, ASN3320 (DTAG Internet service provider operations, DE),
Reverse DNS
Software: CM4all Webserver /
Resource Hash

Request headers

Accept-Language: fi-FI,fi;q=0.9;q=0.9
Referer: https://applogindanske.hier-im-netz.de/app/fi/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date: Tue, 21 May 2024 10:56:52 GMT
server: CM4all Webserver
content-length: 196
content-type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK danske-bank-logo.svg
danskebank.fi/-/media/danske-bank/img/ 4 KB
5 KB 302ms
76ms Image
image/svg+xml 212.93.61.97
DANSKEBANK-AS Aar...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://danskebank.fi/-/media/danske-bank/img/danske-bank-logo.svg

Requested by

Host: applogindanske.hier-im-netz.de
URL: https://applogindanske.hier-im-netz.de/app/fi/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

212.93.61.97 Gentofte Municipality, Denmark, ASN12483 (DANSKEBANK-AS Aarhus Denmark, DK),

Reverse DNS

Software

Resource Hash

2566dcb0230f1ae2412d24ade3f940e3e6a6b3b6ee40501711bf53abc19386a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: fi-FI,fi;q=0.9;q=0.9
Referer: https://applogindanske.hier-im-netz.de/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Date: Tue, 21 May 2024 10:56:52 GMT
Strict-Transport-Security: max-age=157680000
X-Content-Type-Options: nosniff
Content-Disposition: inline; filename="danske-bank-logo.svg"
Connection: keep-alive
Content-Length: 4322
X-Xss-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 07 Feb 2018 13:37:02 GMT
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
ETag: dcb1c2e36945431fa0c242285e339349
X-Frame-Options: DENY
Access-Control-Allow-Methods: GET,POST,PUT,DELETE,OPTIONS
Content-Type: image/svg+xml
Origin-Agent-Cluster: ?0
X-Farm: 7B
Cache-Control: public, max-age=1800
Accept-Ranges: bytes
Access-Control-Allow-Headers: Content-Type

GET dk_text-webfont.50529db33ac4e983017c.woff2
shared-logon.danskebank.com/logon/default/static/media/ 0
0

GET
H/1.1 200
OK danske-bank-logo.svg
danskebank.fi/-/media/danske-bank/img/ 4 KB
0 0ms
0ms Other
image/svg+xml 212.93.61.97
DANSKEBANK-AS Aar...

General

Check archive.org

Show headers Download Go to

Full URL

https://danskebank.fi/-/media/danske-bank/img/danske-bank-logo.svg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

212.93.61.97 Gentofte Municipality, Denmark, ASN12483 (DANSKEBANK-AS Aarhus Denmark, DK),

Reverse DNS

Software

Resource Hash

2566dcb0230f1ae2412d24ade3f940e3e6a6b3b6ee40501711bf53abc19386a7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: fi-FI,fi;q=0.9;q=0.9
Referer: https://applogindanske.hier-im-netz.de/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Date: Tue, 21 May 2024 10:56:52 GMT
X-Content-Type-Options: nosniff
Content-Disposition: inline; filename="danske-bank-logo.svg"
Content-Length: 4322
X-Xss-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 07 Feb 2018 13:37:02 GMT
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
ETag: dcb1c2e36945431fa0c242285e339349
X-Frame-Options: DENY
Access-Control-Allow-Methods: GET,POST,PUT,DELETE,OPTIONS
Content-Type: image/svg+xml
Origin-Agent-Cluster: ?0
X-Farm: 7B
Cache-Control: public, max-age=1800
Accept-Ranges: bytes
Access-Control-Allow-Headers: Content-Type

GET
H2 404 favicon.ico
applogindanske.hier-im-netz.de/app/fi/ 196 B
247 B 75ms
75ms Other
text/html 2003:2:2:15:80:150:6:138
DTAG Internet ser...

General

Check archive.org

Show headers Download Go to

Full URL: https://applogindanske.hier-im-netz.de/app/fi/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2003:2:2:15:80:150:6:138 , Germany, ASN3320 (DTAG Internet service provider operations, DE),
Reverse DNS
Software: CM4all Webserver /
Resource Hash: 80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880

Request headers

Accept-Language: fi-FI,fi;q=0.9;q=0.9
Referer: https://applogindanske.hier-im-netz.de/app/fi/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date: Tue, 21 May 2024 10:56:53 GMT
server: CM4all Webserver
content-length: 196
content-type: text/html; charset=iso-8859-1

GET dk_text-webfont.c9aa6505bf324e3397eb.woff
shared-logon.danskebank.com/logon/default/static/media/ 0
0

GET dk_text-webfont.09946ad1b366746e0749.ttf
shared-logon.danskebank.com/logon/default/static/media/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: shared-logon.danskebank.com
URL: https://shared-logon.danskebank.com/logon/default/static/media/dk_text-webfont.50529db33ac4e983017c.woff2

Domain: shared-logon.danskebank.com
URL: https://shared-logon.danskebank.com/logon/default/static/media/dk_text-webfont.c9aa6505bf324e3397eb.woff

Domain: shared-logon.danskebank.com
URL: https://shared-logon.danskebank.com/logon/default/static/media/dk_text-webfont.09946ad1b366746e0749.ttf

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Danske Bank (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| loadCode

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

8 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://applogindanske.hier-im-netz.de/app/fi/static/css/main.2b901aef.css Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://applogindanske.hier-im-netz.de/app/fi/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()
javascript	error	URL: https://applogindanske.hier-im-netz.de/app/fi/ Message: Access to font at 'https://shared-logon.danskebank.com/logon/default/static/media/dk_text-webfont.50529db33ac4e983017c.woff2' from origin 'https://applogindanske.hier-im-netz.de' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://shared-logon.danskebank.com/logon/default/static/media/dk_text-webfont.50529db33ac4e983017c.woff2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://applogindanske.hier-im-netz.de/app/fi/ Message: Access to font at 'https://shared-logon.danskebank.com/logon/default/static/media/dk_text-webfont.c9aa6505bf324e3397eb.woff' from origin 'https://applogindanske.hier-im-netz.de' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://shared-logon.danskebank.com/logon/default/static/media/dk_text-webfont.c9aa6505bf324e3397eb.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://applogindanske.hier-im-netz.de/app/fi/ Message: Access to font at 'https://shared-logon.danskebank.com/logon/default/static/media/dk_text-webfont.09946ad1b366746e0749.ttf' from origin 'https://applogindanske.hier-im-netz.de' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://shared-logon.danskebank.com/logon/default/static/media/dk_text-webfont.09946ad1b366746e0749.ttf Message: Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

applogindanske.hier-im-netz.de
danskebank.fi
shared-logon.danskebank.com
shared-logon.danskebank.com
2003:2:2:15:80:150:6:138
212.93.38.8
212.93.61.97
1989ffa455347abef138d3b062053584d7c0d052ee80ca2abfd8bfc6a57d66a8
2566dcb0230f1ae2412d24ade3f940e3e6a6b3b6ee40501711bf53abc19386a7
80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
f0228a65851c12b5da774f1ee2d931aa3fd2352914ef6de25c1c9d6dd1426627

applogindanske.hier-im-netz.de Open in urlscan Pro 2003:2:2:15:80:150:6:138 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

9 Requests

67 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

4 IPs

2 Countries

11 kBTransfer

18 kBSize

0 Cookies

0 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

8 Console Messages

Indicators

applogindanske.hier-im-netz.de Open in urlscan Pro
2003:2:2:15:80:150:6:138 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

67 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

11 kB
Transfer

18 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!