cert.nord.id.20-77-73-54.cprapid.com Open in urlscan Pro
20.77.73.54 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://haobofz.com/nord.php
Effective URL:
https://cert.nord.id.20-77-73-54.cprapid.com/mit/home.php?&return_url=2a28fe4a8d98a0e8d841d7728605b1eb&enrolmentID=be1b5068277d148d8e0a89d8a4...
Submission: On October 26 via manual (October 26th 2022, 2:21:07 pm UTC) from DK — Scanned from DK

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 7 IPs in 4 countries across 5 domains to perform 16 HTTP transactions. The main IP is 20.77.73.54, located in London, United Kingdom and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is cert.nord.id.20-77-73-54.cprapid.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on October 22nd 2022. Valid for: 3 months.

This is the only time cert.nord.id.20-77-73-54.cprapid.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Nordea (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	219.234.31.145 219.234.31.145	139021 (WEST263GO...) (WEST263GO-HK West263 International Limited)
1 3	20.77.73.54 20.77.73.54	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2606:4700:10:... 2606:4700:10::6816:4bab	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	51.89.24.70 51.89.24.70	16276 (OVH) (OVH)
1	104.18.19.39 104.18.19.39	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	67.202.105.34 67.202.105.34	32748 (STEADFAST) (STEADFAST)
16	7

1 219.234.31.145 (China)

ASN139021 (WEST263GO-HK West263 International Limited, HK)

haobofz.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 20.77.73.54 (London, United Kingdom) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

cert.nord.id.20-77-73-54.cprapid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:10::6816:4bab (United States)

ASN13335 (CLOUDFLARENET, US)

widgets.amung.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
whos.amung.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 51.89.24.70 (London, United Kingdom)

ASN16276 (OVH, FR)
PTR: ip70.ip-51-89-24.eu

t.dtscout.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.19.39 (Shahr, Iran, Islamic Republic Of)

ASN13335 (CLOUDFLARENET, US)

cdn.tynt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 67.202.105.34 (United States)

ASN32748 (STEADFAST, US)
PTR: ip34.67-202-105.static.steadfastdns.net

ic.tynt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
de.tynt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	tynt.com cdn.tynt.com — Cisco Umbrella Rank: 9607 ic.tynt.com — Cisco Umbrella Rank: 5320 de.tynt.com — Cisco Umbrella Rank: 1517	9 KB
3	cprapid.com 1 redirects cert.nord.id.20-77-73-54.cprapid.com	456 KB
2	dtscout.com t.dtscout.com — Cisco Umbrella Rank: 13471	3 KB
2	amung.us widgets.amung.us — Cisco Umbrella Rank: 19551 whos.amung.us — Cisco Umbrella Rank: 15127	4 KB
1	haobofz.com haobofz.com	411 B
16	5

	Domain	Requested by
7	ic.tynt.com
3	cert.nord.id.20-77-73-54.cprapid.com	1 redirects haobofz.com cert.nord.id.20-77-73-54.cprapid.com
2	t.dtscout.com	widgets.amung.us t.dtscout.com
1	de.tynt.com	cdn.tynt.com
1	cdn.tynt.com	widgets.amung.us
1	whos.amung.us	widgets.amung.us
1	widgets.amung.us	cert.nord.id.20-77-73-54.cprapid.com
1	haobofz.com
16	8

This site contains no links.

Subject Issuer	Validity	Valid
cert.nord.id.20-77-73-54.cprapid.com cPanel, Inc. Certification Authority	`2022-10-22` - `2023-01-20`	3 months	crt.sh
*.amung.us Sectigo RSA Domain Validation Secure Server CA	`2022-05-18` - `2023-06-17`	a year	crt.sh
*.dtscout.com Sectigo RSA Domain Validation Secure Server CA	`2021-10-28` - `2022-11-27`	a year	crt.sh
*.tynt.com Sectigo RSA Domain Validation Secure Server CA	`2022-09-07` - `2023-09-30`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://cert.nord.id.20-77-73-54.cprapid.com/mit/home.php?&return_url=2a28fe4a8d98a0e8d841d7728605b1eb&enrolmentID=be1b5068277d148d8e0a89d8a4ef82a2?securessl=true
Frame ID: 13031B42A6F64E9D28564C6A67C79D17
Requests: 22 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Nordea - identifikation

Page URL History Show full URLs

http://haobofz.com/nord.php Page URL
https://cert.nord.id.20-77-73-54.cprapid.com/mit/ HTTP 302
https://cert.nord.id.20-77-73-54.cprapid.com/mit/home.php?&return_url=2a28fe4a8d98a0e8d841d7728605b1eb&enrolmentID=be1b50... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

16
Requests

94 %
HTTPS

17 %
IPv6

5
Domains

8
Subdomains

7
IPs

4
Countries

524 kB
Transfer

614 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://haobofz.com/nord.php Page URL
https://cert.nord.id.20-77-73-54.cprapid.com/mit/ HTTP 302
https://cert.nord.id.20-77-73-54.cprapid.com/mit/home.php?&return_url=2a28fe4a8d98a0e8d841d7728605b1eb&enrolmentID=be1b5068277d148d8e0a89d8a4ef82a2?securessl=true Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
6 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	nord.php haobofz.com/	211 B 411 B	549ms 325ms	Document text/html	219.234.31.145 WEST263GO-HK West...
General Check archive.org Show headers Download Go to Full URL http://haobofz.com/nord.php Protocol HTTP/1.1 Server 219.234.31.145 , China, ASN139021 (WEST263GO-HK West263 International Limited, HK), Reverse DNS Software wts/1.6.4 / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 accept-language da-DK,da;q=0.9 Response headers Connection keep-alive Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Wed, 26 Oct 2022 14:21:01 GMT Server wts/1.6.4 Transfer-Encoding chunked Vary Accept-Encoding
GET H/1.1	200 OK	Primary Request home.php Show response cert.nord.id.20-77-73-54.cprapid.com/mit/ Redirect Chain https://cert.nord.id.20-77-73-54.cprapid.com/mit/ https://cert.nord.id.20-77-73-54.cprapid.com/mit/home.php?&return_url=2a28fe4a8d98a0e8d841d7728605b1eb&enrolmentID=be1b5068277d148d8e0a89d8a4ef82a2?securessl=true	28 KB 28 KB	77ms 77ms	Document text/html	20.77.73.54 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://cert.nord.id.20-77-73-54.cprapid.com/mit/home.php?&return_url=2a28fe4a8d98a0e8d841d7728605b1eb&enrolmentID=be1b5068277d148d8e0a89d8a4ef82a2?securessl=true Requested by Host: haobofz.com URL: http://haobofz.com/nord.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 20.77.73.54 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash `594d70151ff966fbb5f33fa0b5dfe3b24bd64eca222036ec7a989440cbeda259` Request headers Referer http://haobofz.com/nord.php Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 accept-language da-DK,da;q=0.9 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Wed, 26 Oct 2022 14:21:02 GMT Keep-Alive timeout=5, max=99 Server Apache Transfer-Encoding chunked Redirect headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Wed, 26 Oct 2022 14:21:02 GMT Keep-Alive timeout=5, max=100 Server Apache Transfer-Encoding chunked location home.php?&return_url=2a28fe4a8d98a0e8d841d7728605b1eb&enrolmentID=be1b5068277d148d8e0a89d8a4ef82a2?securessl=true
GET H/1.1	200 OK	main.css cert.nord.id.20-77-73-54.cprapid.com/mit/partials/css/	428 KB 428 KB	61ms 61ms	Stylesheet text/css	20.77.73.54 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://cert.nord.id.20-77-73-54.cprapid.com/mit/partials/css/main.css Requested by Host: cert.nord.id.20-77-73-54.cprapid.com URL: https://cert.nord.id.20-77-73-54.cprapid.com/mit/home.php?&return_url=2a28fe4a8d98a0e8d841d7728605b1eb&enrolmentID=be1b5068277d148d8e0a89d8a4ef82a2?securessl=true Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 20.77.73.54 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash `341b6d608d346d2b16e5e710b4595379786d7e59b1c5a78b4d8fc2985bb51aea` Request headers accept-language da-DK,da;q=0.9 Referer https://cert.nord.id.20-77-73-54.cprapid.com/mit/home.php?&return_url=2a28fe4a8d98a0e8d841d7728605b1eb&enrolmentID=be1b5068277d148d8e0a89d8a4ef82a2?securessl=true User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Pragma no-cache Date Wed, 26 Oct 2022 14:21:02 GMT Last-Modified Sun, 23 Oct 2022 11:50:10 GMT Server Apache Content-Type text/css Cache-Control no-cache, no-store, must-revalidate Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 438029 Expires 0
GET DATA	200 OK	truncated /	2 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `6bb27299ef7a2f71792920ae936f4f0800cf1a43ff5f8b4c835233fde4c1e387` Request headers accept-language da-DK,da;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	9 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `acc90b5255f375e13cc61f865040478454f42cde1dbdc69ae4c9f09431866417` Request headers accept-language da-DK,da;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	67 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `836393ac52708bd75b2e1c88defb51faa58f0fdfa374d57d2529e0a6554882ff` Request headers accept-language da-DK,da;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	26 KB 26 KB		Font application/font-woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `443bd1fde75a477eaae12ba7828c6cb67608e14bbda783027fca2540c3bb0b03` Request headers Referer Origin https://cert.nord.id.20-77-73-54.cprapid.com accept-language da-DK,da;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Content-Type application/font-woff2
GET DATA	200 OK	truncated /	26 KB 26 KB		Font application/font-woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a93f6086756b2a2e94db8aaf795faab950a315cd9a8e32c5b0df707636dedfff` Request headers Referer Origin https://cert.nord.id.20-77-73-54.cprapid.com accept-language da-DK,da;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Content-Type application/font-woff2
GET H2	200	small.js Show response widgets.amung.us/	8 KB 4 KB	210ms 64ms	Script application/x-javascript	2606:4700:10::6816:4bab CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://widgets.amung.us/small.js Requested by Host: cert.nord.id.20-77-73-54.cprapid.com URL: https://cert.nord.id.20-77-73-54.cprapid.com/mit/home.php?&return_url=2a28fe4a8d98a0e8d841d7728605b1eb&enrolmentID=be1b5068277d148d8e0a89d8a4ef82a2?securessl=true Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6816:4bab , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `eee6ef188662ab76c29c720cab899af19bad8153a9c86d548d90b3fa46886fc9` Request headers accept-language da-DK,da;q=0.9 Referer https://cert.nord.id.20-77-73-54.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers date Wed, 26 Oct 2022 14:21:02 GMT content-encoding gzip cf-cache-status HIT last-modified Tue, 25 Oct 2022 20:11:38 GMT server cloudflare age 867 etag W/"635842fa-2142" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * cache-control max-age=86400 cf-ray 7603d60b9b7b900a-FRA expires Thu, 27 Oct 2022 14:06:35 GMT
GET H/1.1	200 OK	/ Show response t.dtscout.com/i/	2 KB 3 KB	257ms 52ms	Script application/javascript	51.89.24.70 OVH
General Check archive.org Show headers Download Go to Full URL https://t.dtscout.com/i/?l=https%3A%2F%2Fcert.nord.id.20-77-73-54.cprapid.com%2Fmit%2Fhome.php%3F%26return_url%3D2a28fe4a8d98a0e8d841d7728605b1eb%26enrolmentID%3Dbe1b5068277d148d8e0a89d8a4ef82a2%3Fsecuressl%3Dtrue&j=http%3A%2F%2Fhaobofz.com%2F Requested by Host: widgets.amung.us URL: https://widgets.amung.us/small.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 51.89.24.70 London, United Kingdom, ASN16276 (OVH, FR), Reverse DNS ip70.ip-51-89-24.eu Software nginx/1.14.0 (Ubuntu) / Resource Hash `e5a9b257a893a1870b81dc7b661a268271d50b6e5e5f3f70bcf3ee4420ed39ff` Request headers accept-language da-DK,da;q=0.9 Referer https://cert.nord.id.20-77-73-54.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Date Wed, 26 Oct 2022 14:21:02 GMT X-T 0.443 Server nginx/1.14.0 (Ubuntu) Transfer-Encoding chunked Content-Type application/javascript Cache-Control no-cache Connection close X-S ger1 Expires Wed, 26 Oct 2022 14:21:01 GMT
GET H2	200	/ Show response whos.amung.us/pingjs/	24 B 125 B	181ms 171ms	Script text/javascript	2606:4700:10::6816:4bab CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://whos.amung.us/pingjs/?k=solo22&t=Nordea%20-%20identifikation&c=s&x=https%3A%2F%2Fcert.nord.id.20-77-73-54.cprapid.com%2Fmit%2Fhome.php%3F%26return_url%3D2a28fe4a8d98a0e8d841d7728605b1eb%26enrolmentID%3Dbe1b5068277d148d8e0a89d8a4ef82a2%3Fsecuressl%3Dtrue&y=http%3A%2F%2Fhaobofz.com%2F&a=0&d=0.882&v=27&r=7071 Requested by Host: widgets.amung.us URL: https://widgets.amung.us/small.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6816:4bab , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `b8a78f226afb7afe5bda2594d57b7d11e8315e49f3ab2e6cdb8a37ddb947b778` Request headers accept-language da-DK,da;q=0.9 Referer https://cert.nord.id.20-77-73-54.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers date Wed, 26 Oct 2022 14:21:02 GMT content-encoding gzip cf-cache-status DYNAMIC server cloudflare cf-ray 7603d60c3cdf900a-FRA content-type text/javascript;charset=UTF-8
GET H2	200	tc.js Show response cdn.tynt.com/	17 KB 7 KB	174ms 61ms	Script application/javascript	104.18.19.39 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.tynt.com/tc.js Requested by Host: widgets.amung.us URL: https://widgets.amung.us/small.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.19.39 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `937458495c30f567aeafe715f0164bfe061ab17aee4a34aabbf191f69a6d32ae` Request headers accept-language da-DK,da;q=0.9 Referer https://cert.nord.id.20-77-73-54.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers date Wed, 26 Oct 2022 14:21:03 GMT content-encoding gzip cf-cache-status HIT last-modified Thu, 21 Jul 2022 14:57:21 GMT server cloudflare age 84175 etag W/"62d96951-4599" vary Accept-Encoding content-type application/javascript cache-control public, max-age=259200 cf-ray 7603d60e09ddbbc2-FRA expires Sat, 29 Oct 2022 14:21:03 GMT
GET DATA	200 OK	truncated /	439 B 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `f6d82f567d08ec91a1b6ef0d4abf21be7a2d3dbc0a41c122584ea3536755b3ac` Request headers accept-language da-DK,da;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Content-Type image/gif
GET H/1.1	200 OK	/ Show response t.dtscout.com/pv/	51 B 319 B	147ms 49ms	Script application/javascript	51.89.24.70 OVH
General Check archive.org Show headers Download Go to Full URL https://t.dtscout.com/pv/?_a=v&_h=cert.nord.id.20-77-73-54.cprapid.com&_ss=4iwbaul0y1&_pv=1&_ls=0&_u1=1&_u3=1&_cc=dk&_pl=d&_cbid=5ejz&_cb=_dtspv.c Requested by Host: t.dtscout.com URL: https://t.dtscout.com/i/?l=https%3A%2F%2Fcert.nord.id.20-77-73-54.cprapid.com%2Fmit%2Fhome.php%3F%26return_url%3D2a28fe4a8d98a0e8d841d7728605b1eb%26enrolmentID%3Dbe1b5068277d148d8e0a89d8a4ef82a2%3Fsecuressl%3Dtrue&j=http%3A%2F%2Fhaobofz.com%2F Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 51.89.24.70 London, United Kingdom, ASN16276 (OVH, FR), Reverse DNS ip70.ip-51-89-24.eu Software nginx/1.14.0 (Ubuntu) / Resource Hash `ca6db5fb062105f4b29683e0432f45a56ad1d62340fb1415a031d56e03d36487` Request headers accept-language da-DK,da;q=0.9 Referer https://cert.nord.id.20-77-73-54.cprapid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Date Wed, 26 Oct 2022 14:21:03 GMT X-T 0.146 Server nginx/1.14.0 (Ubuntu) Transfer-Encoding chunked X-C 0 Content-Type application/javascript Cache-Control no-cache Connection close Expires Wed, 26 Oct 2022 14:21:02 GMT
GET H2	204	p ic.tynt.com/b/	0 227 B	734ms 133ms	Image text/plain	67.202.105.34 STEADFAST
General Check archive.org Show headers Download Go to Show image Full URL https://ic.tynt.com/b/p?id=w!solo22&lm=0&ts=1666794063143&dn=TC&iso=0&r=http%3A%2F%2Fhaobofz.com%2F&t=Nordea%20-%20identifikation Protocol H2 Security TLS 1.3, , AES_256_GCM Server 67.202.105.34 , United States, ASN32748 (STEADFAST, US), Reverse DNS ip34.67-202-105.static.steadfastdns.net Software nginx/1.16.1 / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language da-DK,da;q=0.9 Referer https://cert.nord.id.20-77-73-54.cprapid.com/mit/home.php?&return_url=2a28fe4a8d98a0e8d841d7728605b1eb&enrolmentID=be1b5068277d148d8e0a89d8a4ef82a2?securessl=true User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers expires "Sat, 26 Jul 1997 05:00:00 GMT" date Wed, 26 Oct 2022 14:21:03 GMT cache-control "no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false" server nginx/1.16.1 p3p CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
GET H2	200	v2 Show response de.tynt.com/deb/	4 B 260 B	400ms 127ms	Script application/javascript	67.202.105.34 STEADFAST
General Check archive.org Show headers Download Go to Full URL https://de.tynt.com/deb/v2?id=w!solo22&dn=TC&cc=1&r=http%3A%2F%2Fhaobofz.com%2F Requested by Host: cdn.tynt.com URL: https://cdn.tynt.com/tc.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 67.202.105.34 , United States, ASN32748 (STEADFAST, US), Reverse DNS ip34.67-202-105.static.steadfastdns.net Software / Resource Hash `d21021784cda31eeae5c8295e047a14bda6ed5a9b5963fca9e7ceb398a9c9179` Request headers accept-language da-DK,da;q=0.9 Referer https://cert.nord.id.20-77-73-54.cprapid.com/mit/home.php?&return_url=2a28fe4a8d98a0e8d841d7728605b1eb&enrolmentID=be1b5068277d148d8e0a89d8a4ef82a2?securessl=true User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers p3p CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA" date Wed, 26 Oct 2022 14:21:02 GMT cache-control max-age=86400 content-type application/javascript accept-ch Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version content-length 4 expires Thu, 27 Oct 2022 14:21:03 GMT
GET H2	204	p ic.tynt.com/b/	0 227 B	136ms 136ms	Image text/plain	67.202.105.34 STEADFAST
General Check archive.org Show headers Download Go to Show image Full URL https://ic.tynt.com/b/p?id=w!solo22&lm=0&ts=1666794063143&dn=TC&iso=0&r=http%3A%2F%2Fhaobofz.com%2F&t=Nordea%20-%20identifikation Protocol H2 Security TLS 1.3, , AES_256_GCM Server 67.202.105.34 , United States, ASN32748 (STEADFAST, US), Reverse DNS ip34.67-202-105.static.steadfastdns.net Software nginx/1.16.1 / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language da-DK,da;q=0.9 Referer https://cert.nord.id.20-77-73-54.cprapid.com/mit/home.php?&return_url=2a28fe4a8d98a0e8d841d7728605b1eb&enrolmentID=be1b5068277d148d8e0a89d8a4ef82a2?securessl=true User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers expires "Sat, 26 Jul 1997 05:00:00 GMT" date Wed, 26 Oct 2022 14:21:03 GMT cache-control "no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false" server nginx/1.16.1 p3p CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
GET H2	204	p ic.tynt.com/b/	0 227 B	133ms 133ms	Image text/plain	67.202.105.34 STEADFAST
General Check archive.org Show headers Download Go to Show image Full URL https://ic.tynt.com/b/p?id=w!solo22&lm=0&ts=1666794063143&dn=TC&iso=0&r=http%3A%2F%2Fhaobofz.com%2F&t=Nordea%20-%20identifikation Protocol H2 Security TLS 1.3, , AES_256_GCM Server 67.202.105.34 , United States, ASN32748 (STEADFAST, US), Reverse DNS ip34.67-202-105.static.steadfastdns.net Software nginx/1.16.1 / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language da-DK,da;q=0.9 Referer https://cert.nord.id.20-77-73-54.cprapid.com/mit/home.php?&return_url=2a28fe4a8d98a0e8d841d7728605b1eb&enrolmentID=be1b5068277d148d8e0a89d8a4ef82a2?securessl=true User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers expires "Sat, 26 Jul 1997 05:00:00 GMT" date Wed, 26 Oct 2022 14:21:04 GMT cache-control "no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false" server nginx/1.16.1 p3p CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
GET H2	204	p ic.tynt.com/b/	0 227 B	134ms 133ms	Image text/plain	67.202.105.34 STEADFAST
General Check archive.org Show headers Download Go to Show image Full URL https://ic.tynt.com/b/p?id=w!solo22&lm=0&ts=1666794063143&dn=TC&iso=0&r=http%3A%2F%2Fhaobofz.com%2F Protocol H2 Security TLS 1.3, , AES_256_GCM Server 67.202.105.34 , United States, ASN32748 (STEADFAST, US), Reverse DNS ip34.67-202-105.static.steadfastdns.net Software nginx/1.16.1 / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language da-DK,da;q=0.9 Referer https://cert.nord.id.20-77-73-54.cprapid.com/mit/home.php?&return_url=2a28fe4a8d98a0e8d841d7728605b1eb&enrolmentID=be1b5068277d148d8e0a89d8a4ef82a2?securessl=true User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers expires "Sat, 26 Jul 1997 05:00:00 GMT" date Wed, 26 Oct 2022 14:21:04 GMT cache-control "no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false" server nginx/1.16.1 p3p CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
GET H2	204	p ic.tynt.com/b/	0 227 B	134ms 133ms	Image text/plain	67.202.105.34 STEADFAST
General Check archive.org Show headers Download Go to Show image Full URL https://ic.tynt.com/b/p?id=w!solo22&lm=0&ts=1666794063143&dn=TC&iso=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 67.202.105.34 , United States, ASN32748 (STEADFAST, US), Reverse DNS ip34.67-202-105.static.steadfastdns.net Software nginx/1.16.1 / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language da-DK,da;q=0.9 Referer https://cert.nord.id.20-77-73-54.cprapid.com/mit/home.php?&return_url=2a28fe4a8d98a0e8d841d7728605b1eb&enrolmentID=be1b5068277d148d8e0a89d8a4ef82a2?securessl=true User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers expires "Sat, 26 Jul 1997 05:00:00 GMT" date Wed, 26 Oct 2022 14:21:04 GMT cache-control "no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false" server nginx/1.16.1 p3p CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
GET H2	204	p ic.tynt.com/b/	0 227 B	134ms 133ms	Image text/plain	67.202.105.34 STEADFAST
General Check archive.org Show headers Download Go to Show image Full URL https://ic.tynt.com/b/p?id=w!solo22&lm=0&ts=1666794063143&dn=TC&iso=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 67.202.105.34 , United States, ASN32748 (STEADFAST, US), Reverse DNS ip34.67-202-105.static.steadfastdns.net Software nginx/1.16.1 / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language da-DK,da;q=0.9 Referer https://cert.nord.id.20-77-73-54.cprapid.com/mit/home.php?&return_url=2a28fe4a8d98a0e8d841d7728605b1eb&enrolmentID=be1b5068277d148d8e0a89d8a4ef82a2?securessl=true User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers expires "Sat, 26 Jul 1997 05:00:00 GMT" date Wed, 26 Oct 2022 14:21:04 GMT cache-control "no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false" server nginx/1.16.1 p3p CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
GET H2	204	p ic.tynt.com/b/	0 227 B	135ms 134ms	Image text/plain	67.202.105.34 STEADFAST
General Check archive.org Show headers Download Go to Show image Full URL https://ic.tynt.com/b/p?id=w!solo22&lm=0&ts=1666794063143&dn=TC&iso=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 67.202.105.34 , United States, ASN32748 (STEADFAST, US), Reverse DNS ip34.67-202-105.static.steadfastdns.net Software nginx/1.16.1 / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language da-DK,da;q=0.9 Referer https://cert.nord.id.20-77-73-54.cprapid.com/mit/home.php?&return_url=2a28fe4a8d98a0e8d841d7728605b1eb&enrolmentID=be1b5068277d148d8e0a89d8a4ef82a2?securessl=true User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers expires "Sat, 26 Jul 1997 05:00:00 GMT" date Wed, 26 Oct 2022 14:21:04 GMT cache-control "no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false" server nginx/1.16.1 p3p CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Nordea (Banking)

29 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.dtscout.com/	1970-01-20 06:59:59	Name: m Value: 1
.dtscout.com/	1970-01-20 07:00:08	Name: oa Value: 1
.dtscout.com/	1970-01-20 09:23:54	Name: df Value: 1666794062

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://cert.nord.id.20-77-73-54.cprapid.com/mit/home.php?&return_url=2a28fe4a8d98a0e8d841d7728605b1eb&enrolmentID=be1b5068277d148d8e0a89d8a4ef82a2?securessl=true(Line 11) Message: X-Frame-Options may only be set via an HTTP header sent along with a document. It may not be set inside <meta>.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.tynt.com
cert.nord.id.20-77-73-54.cprapid.com
de.tynt.com
haobofz.com
ic.tynt.com
t.dtscout.com
whos.amung.us
widgets.amung.us
104.18.19.39
20.77.73.54
219.234.31.145
2606:4700:10::6816:4bab
51.89.24.70
67.202.105.34
341b6d608d346d2b16e5e710b4595379786d7e59b1c5a78b4d8fc2985bb51aea
443bd1fde75a477eaae12ba7828c6cb67608e14bbda783027fca2540c3bb0b03
594d70151ff966fbb5f33fa0b5dfe3b24bd64eca222036ec7a989440cbeda259
6bb27299ef7a2f71792920ae936f4f0800cf1a43ff5f8b4c835233fde4c1e387
836393ac52708bd75b2e1c88defb51faa58f0fdfa374d57d2529e0a6554882ff
937458495c30f567aeafe715f0164bfe061ab17aee4a34aabbf191f69a6d32ae
a93f6086756b2a2e94db8aaf795faab950a315cd9a8e32c5b0df707636dedfff
acc90b5255f375e13cc61f865040478454f42cde1dbdc69ae4c9f09431866417
b8a78f226afb7afe5bda2594d57b7d11e8315e49f3ab2e6cdb8a37ddb947b778
ca6db5fb062105f4b29683e0432f45a56ad1d62340fb1415a031d56e03d36487
d21021784cda31eeae5c8295e047a14bda6ed5a9b5963fca9e7ceb398a9c9179
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5a9b257a893a1870b81dc7b661a268271d50b6e5e5f3f70bcf3ee4420ed39ff
eee6ef188662ab76c29c720cab899af19bad8153a9c86d548d90b3fa46886fc9
f6d82f567d08ec91a1b6ef0d4abf21be7a2d3dbc0a41c122584ea3536755b3ac

cert.nord.id.20-77-73-54.cprapid.com Open in urlscan Pro 20.77.73.54 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

16 Requests

94 %HTTPS

17 %IPv6

5 Domains

8 Subdomains

7 IPs

4 Countries

524 kBTransfer

614 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

29 JavaScript Global Variables

3 Cookies

1 Console Messages

Indicators

cert.nord.id.20-77-73-54.cprapid.com Open in urlscan Pro
20.77.73.54 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

94 %
HTTPS

17 %
IPv6

5
Domains

8
Subdomains

7
IPs

4
Countries

524 kB
Transfer

614 kB
Size

3
Cookies

16 HTTP transactions
6 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!