www.nordea-kundeservice.io Open in urlscan Pro
67.205.43.191 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://allymcbealaml7.blogspot.com/
Effective URL:
https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/willkommen.php?DE=879491889fe4015bdf031c2509252a48
Submission: On March 25 via api (March 25th 2022, 11:09:42 am UTC) from US — Scanned from DE

Summary HTTP 14 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 14 HTTP transactions. The main IP is 67.205.43.191, located in United States and belongs to DREAMHOST-AS, US. The main domain is www.nordea-kundeservice.io.
TLS certificate: Issued by R3 on March 10th 2022. Valid for: 3 months.

This is the only time www.nordea-kundeservice.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DKB (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	2a00:1450:400... 2a00:1450:4001:80f::2001	15169 (GOOGLE) (GOOGLE)
2 13	67.205.43.191 67.205.43.191	26347 (DREAMHOST-AS) (DREAMHOST-AS)
1	2a00:1450:400... 2a00:1450:4001:831::200a	15169 (GOOGLE) (GOOGLE)
1	2a06:98c1:312... 2a06:98c1:3120::7	13335 (CLOUDFLAR...) (CLOUDFLARENET)
14	5

1 2a00:1450:4001:80f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

allymcbealaml7.blogspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 67.205.43.191 (United States) 2 redirects

ASN26347 (DREAMHOST-AS, US)
PTR: vps11258.dreamhostps.com

www.nordea-kundeservice.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a06:98c1:3120::7 (United States)

ASN13335 (CLOUDFLARENET, US)

freegeoip.app	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	nordea-kundeservice.io 2 redirects www.nordea-kundeservice.io	248 KB
1	freegeoip.app freegeoip.app — Cisco Umbrella Rank: 19121	951 B
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 251	31 KB
1	blogspot.com allymcbealaml7.blogspot.com	15 KB
14	4

	Domain	Requested by
13	www.nordea-kundeservice.io	2 redirects allymcbealaml7.blogspot.com ajax.googleapis.com www.nordea-kundeservice.io
1	freegeoip.app	ajax.googleapis.com
1	ajax.googleapis.com	www.nordea-kundeservice.io
1	allymcbealaml7.blogspot.com
14	4

This site contains links to these domains. Also see Links.

Domain
www.dkb.de

Subject Issuer	Validity	Valid
misc-sni.blogspot.com GTS CA 1C3	`2022-03-17` - `2022-06-09`	3 months	crt.sh
www.nordea-kundeservice.io R3	`2022-03-10` - `2022-06-08`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-03-17` - `2022-06-09`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-08-11` - `2022-08-10`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/willkommen.php?DE=879491889fe4015bdf031c2509252a48
Frame ID: E87F2E6B85A1D2A6282F78FEE51B6F64
Requests: 26 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

DKB - Deutsche Kreditbank AG - Internet Banking

Page URL History Show full URLs

https://allymcbealaml7.blogspot.com/ Page URL
https://www.nordea-kundeservice.io/J/2EY08L41VG4AML7/ Page URL
https://www.nordea-kundeservice.io/J/indexx.php HTTP 302
https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36 HTTP 301
https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/ Page URL
https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/willkommen.php?DE=879491889fe4015bdf0... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

14
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

295 kB
Transfer

1403 kB
Size

1
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://www.dkb.de/banking
Title: Anmelden

Search URL Search Domain Scan URL

URL: https://www.dkb.de/Welcome/content/GuestContact.xhtml?$event=%24pageflow-start
Title: Zum Kontaktformular

Search URL Search Domain Scan URL

URL: https://www.dkb.de/

Search URL Search Domain Scan URL

URL: https://www.dkb.de/banking
Title: zur Desktop Ansicht

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://allymcbealaml7.blogspot.com/ Page URL
https://www.nordea-kundeservice.io/J/2EY08L41VG4AML7/ Page URL
https://www.nordea-kundeservice.io/J/indexx.php HTTP 302
https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36 HTTP 301
https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/ Page URL
https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/willkommen.php?DE=879491889fe4015bdf031c2509252a48 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4

https://www.nordea-kundeservice.io/J/indexx.php HTTP 302
https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36 HTTP 301
https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/

14 HTTP transactions
12 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 /
allymcbealaml7.blogspot.com/ 70 KB
15 KB 300ms
234ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://allymcbealaml7.blogspot.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

content-type: text/html; charset=UTF-8
expires: Fri, 25 Mar 2022 11:09:36 GMT
date: Fri, 25 Mar 2022 11:09:36 GMT
cache-control: private, max-age=0
last-modified: Fri, 25 Mar 2022 10:06:15 GMT
etag: W/"06f8d76b4764021cea14d7b17f6e9ce788a3c685c799e9b3185f74f2863e7da9"
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 15265
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 / Show response
www.nordea-kundeservice.io/J/2EY08L41VG4AML7/ 315 B
372 B 1141ms
700ms Document
text/html 67.205.43.191
DREAMHOST-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.nordea-kundeservice.io/J/2EY08L41VG4AML7/
Requested by: Host: allymcbealaml7.blogspot.com
URL: https://allymcbealaml7.blogspot.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.205.43.191 , United States, ASN26347 (DREAMHOST-AS, US),
Reverse DNS: vps11258.dreamhostps.com
Software: Apache /
Resource Hash: a6697948ab9d3813a777a3f2185eca05d3ea182abbca8487ec23a3bcb1a74106

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://allymcbealaml7.blogspot.com/

Response headers

date: Fri, 25 Mar 2022 11:09:37 GMT
server: Apache
cache-control: max-age=600
expires: Fri, 25 Mar 2022 11:19:37 GMT
vary: Accept-Encoding,User-Agent
content-encoding: gzip
content-length: 233
content-type: text/html; charset=UTF-8

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.4.1/ 86 KB
31 KB 31ms
8ms Script
text/javascript 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js

Requested by

Host: www.nordea-kundeservice.io
URL: https://www.nordea-kundeservice.io/J/2EY08L41VG4AML7/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nordea-kundeservice.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 12:08:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 82882
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30774
x-xss-protection: 0
last-modified: Mon, 13 May 2019 14:37:17 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 24 Mar 2023 12:08:16 GMT

GET
H2 200 /
freegeoip.app/json/ 249 B
951 B 127ms
79ms XHR
application/json 2a06:98c1:3120::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://freegeoip.app/json/
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.nordea-kundeservice.io/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:09:38 GMT
via: kong/2.5.1
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
ratelimit-reset: 3022
x-kong-proxy-latency: 0
x-kong-upstream-latency: 1
x-ratelimit-limit-hour: 1200
x-database-date: Tue, 22 Mar 2022 15:29:43 GMT
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8S8W7kZCxXs89h63TkXWdTXxeILKFlvpiZiQmK0hqfxQdEdBdbFWuO07njz%2Ffy%2B9KRm4XygBZhHeWu82l2Rob72Gi1TBgGW1CX6MuCduy6KvaBOSUG5%2B%2FbF1XTFEwcx4tU%2BwafEE3XLHcy0S"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://www.nordea-kundeservice.io
access-control-allow-credentials: true
x-ratelimit-remaining-hour: 1199
ratelimit-limit: 1200
cf-ray: 6f173209ae895a1f-MXP
ratelimit-remaining: 1199

GET
H2

200

/ Show response
www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/
Redirect Chain

https://www.nordea-kundeservice.io/J/indexx.php
https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36
https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/

96 B
148 B

190ms
190ms

Document
text/html

67.205.43.191
DREAMHOST-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.205.43.191 , United States, ASN26347 (DREAMHOST-AS, US),
Reverse DNS: vps11258.dreamhostps.com
Software: Apache /
Resource Hash: c54336afbdcd7d24e77398c48d015b2bd34f5d852198e48c9d293eb0447c3879

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.nordea-kundeservice.io/J/2EY08L41VG4AML7/

Response headers

date: Fri, 25 Mar 2022 11:09:38 GMT
server: Apache
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
vary: Accept-Encoding,User-Agent
content-encoding: gzip
content-length: 116
content-type: text/html; charset=UTF-8

Redirect headers

date: Fri, 25 Mar 2022 11:09:38 GMT
server: Apache
location: https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/
cache-control: max-age=600
expires: Fri, 25 Mar 2022 11:19:38 GMT
content-length: 282
content-type: text/html; charset=iso-8859-1

GET
H2 200 Primary Request willkommen.php Show response
www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/ 85 KB
12 KB 190ms
189ms Document
text/html 67.205.43.191
DREAMHOST-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/willkommen.php?DE=879491889fe4015bdf031c2509252a48
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.205.43.191 , United States, ASN26347 (DREAMHOST-AS, US),
Reverse DNS: vps11258.dreamhostps.com
Software: Apache /
Resource Hash: b21a759feeff48f54abd5dc43daab5ed617c5136c4dd4f442e7d6401a2b4fd39

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/

Response headers

date: Fri, 25 Mar 2022 11:09:38 GMT
server: Apache
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
vary: Accept-Encoding,User-Agent
content-encoding: gzip
content-type: text/html; charset=UTF-8

GET
H2 404 dkbDtMon_ICA23hjrx_7000200111059.htm
www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/fille/ 0
0 125ms
123ms Script
text/html 67.205.43.191
DREAMHOST-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/fille/dkbDtMon_ICA23hjrx_7000200111059.htm
Requested by: Host: www.nordea-kundeservice.io
URL: https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/willkommen.php?DE=879491889fe4015bdf031c2509252a48
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.205.43.191 , United States, ASN26347 (DREAMHOST-AS, US),
Reverse DNS: vps11258.dreamhostps.com
Software: Apache /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/willkommen.php?DE=879491889fe4015bdf031c2509252a48
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:09:39 GMT
server: Apache
content-length: 315
content-type: text/html; charset=iso-8859-1

GET
H2 200 dkb-global.css
www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/fille/ 277 KB
45 KB 138ms
137ms Stylesheet
text/css 67.205.43.191
DREAMHOST-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/fille/dkb-global.css
Requested by: Host: www.nordea-kundeservice.io
URL: https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/willkommen.php?DE=879491889fe4015bdf031c2509252a48
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.205.43.191 , United States, ASN26347 (DREAMHOST-AS, US),
Reverse DNS: vps11258.dreamhostps.com
Software: Apache /
Resource Hash: be3f43dd84ee4bd28ef5408b9fdb3725e28bb4c2007eec83a824aca41a1b69f0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/willkommen.php?DE=879491889fe4015bdf031c2509252a48
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:09:39 GMT
content-encoding: gzip
last-modified: Fri, 25 Mar 2022 11:09:38 GMT
server: Apache
etag: W/"4532d-5db08ff9ec192-gzip"
vary: Accept-Encoding,User-Agent
content-type: text/css
cache-control: max-age=2592000
accept-ranges: bytes
expires: Sun, 24 Apr 2022 11:09:39 GMT

GET
H2 200 dkb_responsive.css
www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/fille/ 619 KB
126 KB 231ms
230ms Stylesheet
text/css 67.205.43.191
DREAMHOST-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/fille/dkb_responsive.css
Requested by: Host: www.nordea-kundeservice.io
URL: https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/willkommen.php?DE=879491889fe4015bdf031c2509252a48
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.205.43.191 , United States, ASN26347 (DREAMHOST-AS, US),
Reverse DNS: vps11258.dreamhostps.com
Software: Apache /
Resource Hash: 30e7695416df0bb4df4d3fba479740252270cd2ba3f5490bdc244dd7debc8f34

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/willkommen.php?DE=879491889fe4015bdf031c2509252a48
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:09:39 GMT
content-encoding: gzip
last-modified: Fri, 25 Mar 2022 11:09:38 GMT
server: Apache
etag: W/"9abc5-5db08ff9ed132-gzip"
vary: Accept-Encoding,User-Agent
content-type: text/css
cache-control: max-age=2592000
accept-ranges: bytes
expires: Sun, 24 Apr 2022 11:09:39 GMT

GET
H2 404 device_optimization.htm
www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/fille/ 0
0 131ms
130ms Script
text/html 67.205.43.191
DREAMHOST-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/fille/device_optimization.htm
Requested by: Host: www.nordea-kundeservice.io
URL: https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/willkommen.php?DE=879491889fe4015bdf031c2509252a48
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.205.43.191 , United States, ASN26347 (DREAMHOST-AS, US),
Reverse DNS: vps11258.dreamhostps.com
Software: Apache /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/willkommen.php?DE=879491889fe4015bdf031c2509252a48
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:09:39 GMT
server: Apache
content-length: 315
content-type: text/html; charset=iso-8859-1

GET
H2 404 ua_parser.htm
www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/fille/ 0
0 136ms
135ms Script
text/html 67.205.43.191
DREAMHOST-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/fille/ua_parser.htm
Requested by: Host: www.nordea-kundeservice.io
URL: https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/willkommen.php?DE=879491889fe4015bdf031c2509252a48
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.205.43.191 , United States, ASN26347 (DREAMHOST-AS, US),
Reverse DNS: vps11258.dreamhostps.com
Software: Apache /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/willkommen.php?DE=879491889fe4015bdf031c2509252a48
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:09:39 GMT
server: Apache
content-length: 315
content-type: text/html; charset=iso-8859-1

GET
H2 404 button-progress-2.htm
www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/fille/ 315 B
315 B 241ms
241ms Image
text/html 67.205.43.191
DREAMHOST-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/fille/button-progress-2.htm
Requested by: Host: www.nordea-kundeservice.io
URL: https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/willkommen.php?DE=879491889fe4015bdf031c2509252a48
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.205.43.191 , United States, ASN26347 (DREAMHOST-AS, US),
Reverse DNS: vps11258.dreamhostps.com
Software: Apache /
Resource Hash: d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/willkommen.php?DE=879491889fe4015bdf031c2509252a48
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:09:39 GMT
server: Apache
content-length: 315
content-type: text/html; charset=iso-8859-1

GET
H2 200 large.jpg
www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/img/ 29 KB
29 KB 241ms
241ms Image
image/jpeg 67.205.43.191
DREAMHOST-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/img/large.jpg
Requested by: Host: www.nordea-kundeservice.io
URL: https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/willkommen.php?DE=879491889fe4015bdf031c2509252a48
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.205.43.191 , United States, ASN26347 (DREAMHOST-AS, US),
Reverse DNS: vps11258.dreamhostps.com
Software: Apache /
Resource Hash: 5408d9f3668d380c3148ecc04f9401c082f980a88d86962bc906baf0d7abdb28

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/willkommen.php?DE=879491889fe4015bdf031c2509252a48
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:09:39 GMT
last-modified: Fri, 25 Mar 2022 11:09:38 GMT
server: Apache
etag: W/"7218-5db08ff9ea252"
vary: User-Agent
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 29208
expires: Sun, 24 Apr 2022 11:09:39 GMT

GET
H2 200 dkb-global-print.css
www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/fille/ 220 KB
35 KB 241ms
241ms Stylesheet
text/css 67.205.43.191
DREAMHOST-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/fille/dkb-global-print.css
Requested by: Host: www.nordea-kundeservice.io
URL: https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/willkommen.php?DE=879491889fe4015bdf031c2509252a48
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.205.43.191 , United States, ASN26347 (DREAMHOST-AS, US),
Reverse DNS: vps11258.dreamhostps.com
Software: Apache /
Resource Hash: 3b7c87bd2c1d2f0fca3cb69101956be390826b855cd585ca9542b2ffa276d74e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/willkommen.php?DE=879491889fe4015bdf031c2509252a48
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:09:39 GMT
content-encoding: gzip
last-modified: Fri, 25 Mar 2022 11:09:38 GMT
server: Apache
etag: W/"36eec-5db08ff9ec192-gzip"
vary: Accept-Encoding,User-Agent
content-type: text/css
cache-control: max-age=2592000
accept-ranges: bytes
expires: Sun, 24 Apr 2022 11:09:39 GMT

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6095c4b2fc25c6534e68ddcbcd1fb58f2634036f75262042c215c74a9285bc79

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 475 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 24483b4771b2128af4110c159a9dcb59d15557460f8ecbf0bd0805f0fad5816e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 948 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0fe9650923b3c4d5d1b829c47a2a4eb9b6931a06132036a02c570e355f53ec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 208 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 72e1af139f74424d56589a3d06474355afb141c3bd72a38d141c19f851bbc2ca

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 846 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3192ba93cb31f7fecf507ab899b4279ced7d91716f9fd5e3b200410375a6cbf0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 686 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0b969bfdbb0496aa56664660247d76c9696b29a6e79a126c38acb9983e058ee9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 944 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fe73e87e02eadba5240358a4eeebeb334e6d8e7eaa9d024f41644241f3adaadd

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1c9524bad0ee009f3f9e6af79cf3363acbcd6a4f03eec2ca8c16ff794358d81d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 669 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a30c546ea7a8f0861fbe49a030bc0fcc707c7de128c265881d4010906d1e5fcb

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 864 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 44916913841d34baa376b3b72911ed27f16629909ed5c4f1a59be98af036e8af

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 871 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 54d31025c9536bf38b4f89d7fdc5261bb87dfe924d7445a7d56b43533c86e8cb

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 5 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5aa97ee206d9655910ece7996d461dc1cdf1550a4487a53d04815c5570bb78ae

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/svg+xml

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DKB (Banking)

35 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.nordea-kundeservice.io/	1969-12-31 23:59:59	Name: PHPSESSID Value: b4ff2c08dcd04627ac63e77e92346432

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/fille/dkbDtMon_ICA23hjrx_7000200111059.htm Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/fille/device_optimization.htm Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/fille/ua_parser.htm Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://www.nordea-kundeservice.io/J/DKB-Deutsche.Kreditbank-193.27.14.36/fille/button-progress-2.htm Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
allymcbealaml7.blogspot.com
freegeoip.app
www.nordea-kundeservice.io
2a00:1450:4001:80f::2001
2a00:1450:4001:831::200a
2a06:98c1:3120::7
67.205.43.191
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
0b969bfdbb0496aa56664660247d76c9696b29a6e79a126c38acb9983e058ee9
0fe9650923b3c4d5d1b829c47a2a4eb9b6931a06132036a02c570e355f53ec87
1c9524bad0ee009f3f9e6af79cf3363acbcd6a4f03eec2ca8c16ff794358d81d
24483b4771b2128af4110c159a9dcb59d15557460f8ecbf0bd0805f0fad5816e
30e7695416df0bb4df4d3fba479740252270cd2ba3f5490bdc244dd7debc8f34
3192ba93cb31f7fecf507ab899b4279ced7d91716f9fd5e3b200410375a6cbf0
3b7c87bd2c1d2f0fca3cb69101956be390826b855cd585ca9542b2ffa276d74e
44916913841d34baa376b3b72911ed27f16629909ed5c4f1a59be98af036e8af
5408d9f3668d380c3148ecc04f9401c082f980a88d86962bc906baf0d7abdb28
54d31025c9536bf38b4f89d7fdc5261bb87dfe924d7445a7d56b43533c86e8cb
5aa97ee206d9655910ece7996d461dc1cdf1550a4487a53d04815c5570bb78ae
6095c4b2fc25c6534e68ddcbcd1fb58f2634036f75262042c215c74a9285bc79
72e1af139f74424d56589a3d06474355afb141c3bd72a38d141c19f851bbc2ca
a30c546ea7a8f0861fbe49a030bc0fcc707c7de128c265881d4010906d1e5fcb
a6697948ab9d3813a777a3f2185eca05d3ea182abbca8487ec23a3bcb1a74106
b21a759feeff48f54abd5dc43daab5ed617c5136c4dd4f442e7d6401a2b4fd39
be3f43dd84ee4bd28ef5408b9fdb3725e28bb4c2007eec83a824aca41a1b69f0
c54336afbdcd7d24e77398c48d015b2bd34f5d852198e48c9d293eb0447c3879
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
fe73e87e02eadba5240358a4eeebeb334e6d8e7eaa9d024f41644241f3adaadd

www.nordea-kundeservice.io Open in urlscan Pro 67.205.43.191 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

14 Requests

100 %HTTPS

75 %IPv6

4 Domains

4 Subdomains

5 IPs

2 Countries

295 kBTransfer

1403 kBSize

1 Cookies

4 Outgoing links

Page URL History

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 12 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

35 JavaScript Global Variables

www.nordea-kundeservice.io Open in urlscan Pro
67.205.43.191 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

295 kB
Transfer

1403 kB
Size

1
Cookies

14 HTTP transactions
12 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!