skatteetaten-no.vitelweb.com Open in urlscan Pro
198.100.153.84 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://skatteetaten-no.vitelweb.com/.Skattekortet2024/
Effective URL:
https://skatteetaten-no.vitelweb.com/.Skattekortet2024/default.php?id=fSLw3L
Submission: On February 06 via manual (February 6th 2024, 12:04:39 pm UTC) from NO — Scanned from NO

Summary HTTP 25 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 3 domains to perform 25 HTTP transactions. The main IP is 198.100.153.84, located in Canada and belongs to OVH, FR. The main domain is skatteetaten-no.vitelweb.com.
TLS certificate: Issued by R3 on February 5th 2024. Valid for: 3 months.

This is the only time skatteetaten-no.vitelweb.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Community Verdicts: Malicious — 1 votes Show Verdicts

Domain & IP information

	IP Address	AS Autonomous System
1 10	198.100.153.84 198.100.153.84	16276 (OVH) (OVH)
7	2a00:1450:400... 2a00:1450:4001:82f::2004	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:828::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:811::2003	15169 (GOOGLE) (GOOGLE)
25	5

10 198.100.153.84 (Canada) 1 redirects

ASN16276 (OVH, FR)
PTR: oso1.osored.com

skatteetaten-no.vitelweb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:82f::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:828::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:811::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	vitelweb.com 1 redirects skatteetaten-no.vitelweb.com	89 KB
7	google.com www.google.com — Cisco Umbrella Rank: 2	66 KB
6	gstatic.com www.gstatic.com fonts.gstatic.com	448 KB
25	3

	Domain	Requested by
10	skatteetaten-no.vitelweb.com	1 redirects skatteetaten-no.vitelweb.com
7	www.google.com	skatteetaten-no.vitelweb.com www.gstatic.com www.google.com
4	www.gstatic.com	www.google.com www.gstatic.com
2	fonts.gstatic.com	www.google.com
25	4

This site contains no links.

Subject Issuer	Validity	Valid
www.skatteetaten-no.vitelweb.com R3	`2024-02-05` - `2024-05-05`	3 months	crt.sh
www.google.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
*.google.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://skatteetaten-no.vitelweb.com/.Skattekortet2024/default.php?id=fSLw3L
Frame ID: 1187CDA819F8AD83F63AC75119F5DF4F
Requests: 14 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfsG2gpAAAAAHkwRPQPX7kbpvPGsgGMy9yYpb7E&co=aHR0cHM6Ly9za2F0dGVldGF0ZW4tbm8udml0ZWx3ZWIuY29tOjQ0Mw..&hl=no&v=MHBiAvbtvk5Wb2eTZHoP1dUd&size=invisible&cb=qc0xw9xmxxhp
Frame ID: D466C9DB95C8E6DA2D5944B4C54AD9F0
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://skatteetaten-no.vitelweb.com/.Skattekortet2024/ Page URL
https://skatteetaten-no.vitelweb.com/.Skattekortet2024/includes/unlock.php HTTP 302
https://skatteetaten-no.vitelweb.com/.Skattekortet2024/default.php?id=fSLw3L Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

/recaptcha/api\.js

Page Statistics

25
Requests

88 %
HTTPS

75 %
IPv6

3
Domains

4
Subdomains

5
IPs

2
Countries

602 kB
Transfer

1666 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://skatteetaten-no.vitelweb.com/.Skattekortet2024/ Page URL
https://skatteetaten-no.vitelweb.com/.Skattekortet2024/includes/unlock.php HTTP 302
https://skatteetaten-no.vitelweb.com/.Skattekortet2024/default.php?id=fSLw3L Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

25 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK / Show response
skatteetaten-no.vitelweb.com/.Skattekortet2024/ 2 KB
1 KB 1478ms
1128ms Document
text/html 198.100.153.84
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://skatteetaten-no.vitelweb.com/.Skattekortet2024/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 198.100.153.84 , Canada, ASN16276 (OVH, FR),
Reverse DNS: oso1.osored.com
Software: Apache / PHP/8.0.29
Resource Hash: d5ebed6cd05cf19136fcc9cae328d2bc7828f564c8b212676fa3385a83eaa89c

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: no-NO,no;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 851
Content-Type: text/html; charset=UTF-8
Date: Tue, 06 Feb 2024 12:04:32 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive: timeout=5, max=100
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding,User-Agent
X-Powered-By: PHP/8.0.29

GET
H/1.1 200
OK bootstrap.min.css
skatteetaten-no.vitelweb.com/.Skattekortet2024/assets/css/ 164 KB
22 KB 192ms
191ms Stylesheet
text/css 198.100.153.84
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://skatteetaten-no.vitelweb.com/.Skattekortet2024/assets/css/bootstrap.min.css
Requested by: Host: skatteetaten-no.vitelweb.com
URL: https://skatteetaten-no.vitelweb.com/.Skattekortet2024/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 198.100.153.84 , Canada, ASN16276 (OVH, FR),
Reverse DNS: oso1.osored.com
Software: Apache /
Resource Hash: d900386109e35c058b7696e4b5eca16bc4fd083dba10de464564e08b69662406

Request headers

accept-language: no-NO,no;q=0.9
Referer: https://skatteetaten-no.vitelweb.com/.Skattekortet2024/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 12:04:33 GMT
Content-Encoding: gzip
Last-Modified: Fri, 02 Feb 2024 03:43:38 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 22157

GET
H/1.1 200
OK ui.css
skatteetaten-no.vitelweb.com/.Skattekortet2024/assets/css/ 9 KB
3 KB 470ms
166ms Stylesheet
text/css 198.100.153.84
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://skatteetaten-no.vitelweb.com/.Skattekortet2024/assets/css/ui.css
Requested by: Host: skatteetaten-no.vitelweb.com
URL: https://skatteetaten-no.vitelweb.com/.Skattekortet2024/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 198.100.153.84 , Canada, ASN16276 (OVH, FR),
Reverse DNS: oso1.osored.com
Software: Apache /
Resource Hash: 310b551da8995cd9f846ca018e4d2a015f7218ff98e99066362035db38a9650f

Request headers

accept-language: no-NO,no;q=0.9
Referer: https://skatteetaten-no.vitelweb.com/.Skattekortet2024/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 12:04:34 GMT
Content-Encoding: gzip
Last-Modified: Fri, 02 Feb 2024 03:58:16 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 2280

GET
H/1.1 200
OK styles.css
skatteetaten-no.vitelweb.com/.Skattekortet2024/assets/css/ 74 KB
9 KB 488ms
174ms Stylesheet
text/css 198.100.153.84
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://skatteetaten-no.vitelweb.com/.Skattekortet2024/assets/css/styles.css
Requested by: Host: skatteetaten-no.vitelweb.com
URL: https://skatteetaten-no.vitelweb.com/.Skattekortet2024/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 198.100.153.84 , Canada, ASN16276 (OVH, FR),
Reverse DNS: oso1.osored.com
Software: Apache /
Resource Hash: cfab0b5276224f067296f6cf7643514afcee77f051ade7fe9995bbf3e217caa9

Request headers

accept-language: no-NO,no;q=0.9
Referer: https://skatteetaten-no.vitelweb.com/.Skattekortet2024/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 12:04:34 GMT
Content-Encoding: gzip
Last-Modified: Mon, 15 Jan 2024 22:10:50 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 9146

GET
H/1.1 200
OK loading.css
skatteetaten-no.vitelweb.com/.Skattekortet2024/assets/css/ 198 KB
33 KB 492ms
179ms Stylesheet
text/css 198.100.153.84
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://skatteetaten-no.vitelweb.com/.Skattekortet2024/assets/css/loading.css
Requested by: Host: skatteetaten-no.vitelweb.com
URL: https://skatteetaten-no.vitelweb.com/.Skattekortet2024/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 198.100.153.84 , Canada, ASN16276 (OVH, FR),
Reverse DNS: oso1.osored.com
Software: Apache /
Resource Hash: eee0de974dc453065f99ef24913aad33ed87c19841d8b1269786e27378fcb53b

Request headers

accept-language: no-NO,no;q=0.9
Referer: https://skatteetaten-no.vitelweb.com/.Skattekortet2024/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 12:04:34 GMT
Content-Encoding: gzip
Last-Modified: Thu, 01 Feb 2024 22:55:06 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 33045

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 1 KB
1 KB 280ms
95ms Script
text/javascript 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js

Requested by

Host: skatteetaten-no.vitelweb.com
URL: https://skatteetaten-no.vitelweb.com/.Skattekortet2024/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

4df8c12e4cb65f016dfc51ce2442a3496d0219756d38ab605809d9341d7a3192

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: no-NO,no;q=0.9
Referer: https://skatteetaten-no.vitelweb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 12:04:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Tue, 06 Feb 2024 12:04:35 GMT

GET
H/1.1 200
OK skatteetaten-logo-sekundar.png
skatteetaten-no.vitelweb.com/.Skattekortet2024/assets/images/ 20 KB
21 KB 489ms
172ms Image
image/png 198.100.153.84
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://skatteetaten-no.vitelweb.com/.Skattekortet2024/assets/images/skatteetaten-logo-sekundar.png
Requested by: Host: skatteetaten-no.vitelweb.com
URL: https://skatteetaten-no.vitelweb.com/.Skattekortet2024/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 198.100.153.84 , Canada, ASN16276 (OVH, FR),
Reverse DNS: oso1.osored.com
Software: Apache /
Resource Hash: 697e7fcf61a6597d600e1f68bf94a254c4b7d9959141ae76a4587b0d05e977b9

Request headers

accept-language: no-NO,no;q=0.9
Referer: https://skatteetaten-no.vitelweb.com/.Skattekortet2024/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 12:04:34 GMT
Last-Modified: Fri, 02 Feb 2024 04:36:30 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 20985

GET
H/1.1 404
Not Found PFDinDisplayPro-Regular.840952ed9468a2c7444f89b6f748e734.woff2
skatteetaten-no.vitelweb.com/.Skattekortet2024/assets/css/images/ 0
0 171ms
171ms Font
text/html 198.100.153.84
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://skatteetaten-no.vitelweb.com/.Skattekortet2024/assets/css/images/PFDinDisplayPro-Regular.840952ed9468a2c7444f89b6f748e734.woff2
Requested by: Host: skatteetaten-no.vitelweb.com
URL: https://skatteetaten-no.vitelweb.com/.Skattekortet2024/assets/css/loading.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 198.100.153.84 , Canada, ASN16276 (OVH, FR),
Reverse DNS: oso1.osored.com
Software: Apache /
Resource Hash

Request headers

Referer: https://skatteetaten-no.vitelweb.com/.Skattekortet2024/assets/css/loading.css
Origin: https://skatteetaten-no.vitelweb.com
accept-language: no-NO,no;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 12:04:34 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found PFDinDisplayPro-Regular.21be48ba435316c8a4cd39438cd89083.woff
skatteetaten-no.vitelweb.com/.Skattekortet2024/assets/css/images/ 0
0 170ms
169ms Font
text/html 198.100.153.84
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://skatteetaten-no.vitelweb.com/.Skattekortet2024/assets/css/images/PFDinDisplayPro-Regular.21be48ba435316c8a4cd39438cd89083.woff
Requested by: Host: skatteetaten-no.vitelweb.com
URL: https://skatteetaten-no.vitelweb.com/.Skattekortet2024/assets/css/loading.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 198.100.153.84 , Canada, ASN16276 (OVH, FR),
Reverse DNS: oso1.osored.com
Software: Apache /
Resource Hash

Request headers

Referer: https://skatteetaten-no.vitelweb.com/.Skattekortet2024/assets/css/loading.css
Origin: https://skatteetaten-no.vitelweb.com
accept-language: no-NO,no;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 12:04:34 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=98
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 recaptcha__no.js Show response
www.gstatic.com/recaptcha/releases/MHBiAvbtvk5Wb2eTZHoP1dUd/ 490 KB
196 KB 265ms
86ms Script
text/javascript 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/MHBiAvbtvk5Wb2eTZHoP1dUd/recaptcha__no.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9f4e013540428f55b7dcb13425cea8191f66c42cc03346ade5562917e13556a4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://skatteetaten-no.vitelweb.com/
Origin: https://skatteetaten-no.vitelweb.com
accept-language: no-NO,no;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 23:26:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 391096
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 199660
x-xss-protection: 0
last-modified: Mon, 29 Jan 2024 03:01:23 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 31 Jan 2025 23:26:19 GMT

GET
H2 200 anchor Show response
www.google.com/recaptcha/api2/ Frame D466 44 KB
28 KB 112ms
111ms Document
text/html 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfsG2gpAAAAAHkwRPQPX7kbpvPGsgGMy9yYpb7E&co=aHR0cHM6Ly9za2F0dGVldGF0ZW4tbm8udml0ZWx3ZWIuY29tOjQ0Mw..&hl=no&v=MHBiAvbtvk5Wb2eTZHoP1dUd&size=invisible&cb=qc0xw9xmxxhp

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/MHBiAvbtvk5Wb2eTZHoP1dUd/recaptcha__no.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

a17dfe1c2dfc5c812672215f8466c508bbe9379a2a627f4ddbe22ba5ef8ee665

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-qczxvvno4ON78KCa2xe6Cw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://skatteetaten-no.vitelweb.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: no-NO,no;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-qczxvvno4ON78KCa2xe6Cw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 06 Feb 2024 12:04:36 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/MHBiAvbtvk5Wb2eTZHoP1dUd/ Frame D466 55 KB
24 KB 256ms
85ms Stylesheet
text/css 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/MHBiAvbtvk5Wb2eTZHoP1dUd/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfsG2gpAAAAAHkwRPQPX7kbpvPGsgGMy9yYpb7E&co=aHR0cHM6Ly9za2F0dGVldGF0ZW4tbm8udml0ZWx3ZWIuY29tOjQ0Mw..&hl=no&v=MHBiAvbtvk5Wb2eTZHoP1dUd&size=invisible&cb=qc0xw9xmxxhp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: no-NO,no;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 10:47:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4638
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24606
x-xss-protection: 0
last-modified: Mon, 29 Jan 2024 03:01:23 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 05 Feb 2025 10:47:18 GMT

GET
H3 200 recaptcha__no.js Show response
www.gstatic.com/recaptcha/releases/MHBiAvbtvk5Wb2eTZHoP1dUd/ Frame D466 490 KB
195 KB 299ms
128ms Script
text/javascript 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/MHBiAvbtvk5Wb2eTZHoP1dUd/recaptcha__no.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9f4e013540428f55b7dcb13425cea8191f66c42cc03346ade5562917e13556a4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: no-NO,no;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 23:26:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 391097
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 199660
x-xss-protection: 0
last-modified: Mon, 29 Jan 2024 03:01:23 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 31 Jan 2025 23:26:19 GMT

GET
H3 200 zftWH1OehvU7cp4CwShG1rGJcDUeSLUwVTlpfhapoYQ.js Show response
www.google.com/js/bg/ Frame D466 17 KB
7 KB 86ms
85ms Script
text/javascript 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/js/bg/zftWH1OehvU7cp4CwShG1rGJcDUeSLUwVTlpfhapoYQ.js

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/MHBiAvbtvk5Wb2eTZHoP1dUd/recaptcha__no.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cdfb561f539e86f53b729e02c12846d6b18970351e48b5305539697e16a9a184

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: no-NO,no;q=0.9
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfsG2gpAAAAAHkwRPQPX7kbpvPGsgGMy9yYpb7E&co=aHR0cHM6Ly9za2F0dGVldGF0ZW4tbm8udml0ZWx3ZWIuY29tOjQ0Mw..&hl=no&v=MHBiAvbtvk5Wb2eTZHoP1dUd&size=invisible&cb=qc0xw9xmxxhp
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Fri, 02 Feb 2024 13:02:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 342098
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6922
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 10:00:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 01 Feb 2025 13:02:58 GMT

GET
H3 200 logo_48.png
www.gstatic.com/recaptcha/api2/ Frame D466 2 KB
2 KB 85ms
85ms Image
image/png 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/logo_48.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/MHBiAvbtvk5Wb2eTZHoP1dUd/styles__ltr.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: no-NO,no;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/MHBiAvbtvk5Wb2eTZHoP1dUd/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 19:56:54 GMT
x-content-type-options: nosniff
age: 58062
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2228
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
expires: Mon, 12 Feb 2024 19:56:54 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame D466 15 KB
16 KB 264ms
85ms Font
font/woff2 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
accept-language: no-NO,no;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 01 Feb 2024 23:26:56 GMT
x-content-type-options: nosniff
age: 391061
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 31 Jan 2025 23:26:56 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame D466 15 KB
15 KB 285ms
106ms Font
font/woff2 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
accept-language: no-NO,no;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Fri, 02 Feb 2024 12:44:28 GMT
x-content-type-options: nosniff
age: 343209
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15552
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:33:02 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 01 Feb 2025 12:44:28 GMT

GET
H3 200 webworker.js
www.google.com/recaptcha/api2/ Frame D466 102 B
135 B 94ms
94ms Other
text/javascript 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/webworker.js?hl=no&v=MHBiAvbtvk5Wb2eTZHoP1dUd

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

906ec59b66d2f7ce699f959ef8e778061a68e4f0bdadb2a8e51a5435af84e170

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: no-NO,no;q=0.9
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfsG2gpAAAAAHkwRPQPX7kbpvPGsgGMy9yYpb7E&co=aHR0cHM6Ly9za2F0dGVldGF0ZW4tbm8udml0ZWx3ZWIuY29tOjQ0Mw..&hl=no&v=MHBiAvbtvk5Wb2eTZHoP1dUd&size=invisible&cb=qc0xw9xmxxhp
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 12:04:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
cross-origin-embedder-policy: require-corp
x-frame-options: SAMEORIGIN
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=300
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Tue, 06 Feb 2024 12:04:36 GMT

POST
H3 200 reload Show response
www.google.com/recaptcha/api2/ Frame D466 15 KB
11 KB 134ms
133ms XHR
application/json 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/reload?k=6LfsG2gpAAAAAHkwRPQPX7kbpvPGsgGMy9yYpb7E

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/MHBiAvbtvk5Wb2eTZHoP1dUd/recaptcha__no.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

6304d9df4df1c8927f12fc5bcf7020b2d992d1e1f9fab5bd985dd55de04fe163

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfsG2gpAAAAAHkwRPQPX7kbpvPGsgGMy9yYpb7E&co=aHR0cHM6Ly9za2F0dGVldGF0ZW4tbm8udml0ZWx3ZWIuY29tOjQ0Mw..&hl=no&v=MHBiAvbtvk5Wb2eTZHoP1dUd&size=invisible&cb=qc0xw9xmxxhp
accept-language: no-NO,no;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: application/x-protobuffer

Response headers

date: Tue, 06 Feb 2024 12:04:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
cache-control: private, max-age=0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Tue, 06 Feb 2024 12:04:37 GMT

POST unlock.php
skatteetaten-no.vitelweb.com/.Skattekortet2024/includes/ 0
0

POST
H3 200 reload Show response
www.google.com/recaptcha/api2/ Frame D466 13 KB
10 KB 120ms
119ms XHR
application/json 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/reload?k=6LfsG2gpAAAAAHkwRPQPX7kbpvPGsgGMy9yYpb7E

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/MHBiAvbtvk5Wb2eTZHoP1dUd/recaptcha__no.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

476bc35c6c83432d72b1e3ab1fae7d2d5dff644a379d810d17125ababa6f525f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfsG2gpAAAAAHkwRPQPX7kbpvPGsgGMy9yYpb7E&co=aHR0cHM6Ly9za2F0dGVldGF0ZW4tbm8udml0ZWx3ZWIuY29tOjQ0Mw..&hl=no&v=MHBiAvbtvk5Wb2eTZHoP1dUd&size=invisible&cb=qc0xw9xmxxhp
accept-language: no-NO,no;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: application/x-protobuffer

Response headers

date: Tue, 06 Feb 2024 12:04:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
cache-control: private, max-age=0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Tue, 06 Feb 2024 12:04:37 GMT

POST unlock.php
skatteetaten-no.vitelweb.com/.Skattekortet2024/includes/ 0
0

POST
H3 200 reload Show response
www.google.com/recaptcha/api2/ Frame D466 13 KB
9 KB 129ms
129ms XHR
application/json 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/reload?k=6LfsG2gpAAAAAHkwRPQPX7kbpvPGsgGMy9yYpb7E

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/MHBiAvbtvk5Wb2eTZHoP1dUd/recaptcha__no.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

f9a7cb7f5c5e01adc3c733cd2bfa8398abb9c2326342e5a59e04ee40bd639871

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfsG2gpAAAAAHkwRPQPX7kbpvPGsgGMy9yYpb7E&co=aHR0cHM6Ly9za2F0dGVldGF0ZW4tbm8udml0ZWx3ZWIuY29tOjQ0Mw..&hl=no&v=MHBiAvbtvk5Wb2eTZHoP1dUd&size=invisible&cb=qc0xw9xmxxhp
accept-language: no-NO,no;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: application/x-protobuffer

Response headers

date: Tue, 06 Feb 2024 12:04:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
cache-control: private, max-age=0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Tue, 06 Feb 2024 12:04:37 GMT

GET
H/1.1

200
OK

Primary Request default.php
skatteetaten-no.vitelweb.com/.Skattekortet2024/
Redirect Chain

https://skatteetaten-no.vitelweb.com/.Skattekortet2024/includes/unlock.php
https://skatteetaten-no.vitelweb.com/.Skattekortet2024/default.php?id=fSLw3L

28 KB
0

167ms
167ms

Document
text/html

198.100.153.84
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://skatteetaten-no.vitelweb.com/.Skattekortet2024/default.php?id=fSLw3L
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 198.100.153.84 , Canada, ASN16276 (OVH, FR),
Reverse DNS: oso1.osored.com
Software: Apache / PHP/8.0.29
Resource Hash

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://skatteetaten-no.vitelweb.com
Referer: https://skatteetaten-no.vitelweb.com/.Skattekortet2024/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: no-NO,no;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 11929
Content-Type: text/html; charset=UTF-8
Date: Tue, 06 Feb 2024 12:04:38 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive: timeout=5, max=98
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding,User-Agent
X-Powered-By: PHP/8.0.29

Redirect headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: Keep-Alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Tue, 06 Feb 2024 12:04:37 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive: timeout=5, max=99
Pragma: no-cache
Server: Apache
Vary: User-Agent
X-Powered-By: PHP/8.0.29
location: ../default.php?id=fSLw3L

GET main.css
skatteetaten-no.vitelweb.com/.Skattekortet2024/assets/css/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: skatteetaten-no.vitelweb.com
URL: https://skatteetaten-no.vitelweb.com/.Skattekortet2024/includes/unlock.php

Domain: skatteetaten-no.vitelweb.com
URL: https://skatteetaten-no.vitelweb.com/.Skattekortet2024/includes/unlock.php

Domain: skatteetaten-no.vitelweb.com
URL: https://skatteetaten-no.vitelweb.com/.Skattekortet2024/assets/css/main.css

Verdicts & Comments Add Verdict or Comment

Malicious task.url
Submitted on February 6th 2024, 12:05:30 pm UTC — From Norway

Threats: Phishing
Brands: Skatteetaten NO
Comment: Phishing targeting Norwegian Tax Administation (Skatteetaten)

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.google.com/recaptcha	1970-01-20 22:32:53	Name: _GRECAPTCHA Value: 09ADVlMi-Sfrfbupp63uO7f75ByF5eweOm8NGDwFpO_XEOhtpUEP4mnjahANRnKlcZN_0DOr6DVYBurQVPv0s5vIM
			skatteetaten-no.vitelweb.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 3c8rimmlk623hqvilkdi2a16t0

7 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://skatteetaten-no.vitelweb.com/.Skattekortet2024/assets/css/images/PFDinDisplayPro-Regular.840952ed9468a2c7444f89b6f748e734.woff2 Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://skatteetaten-no.vitelweb.com/.Skattekortet2024/assets/css/images/PFDinDisplayPro-Regular.21be48ba435316c8a4cd39438cd89083.woff Message: Failed to load resource: the server responded with a status of 404 (Not Found)
other	warning	URL: https://skatteetaten-no.vitelweb.com/.Skattekortet2024/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://skatteetaten-no.vitelweb.com/.Skattekortet2024/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://skatteetaten-no.vitelweb.com/.Skattekortet2024/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://skatteetaten-no.vitelweb.com/.Skattekortet2024/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://skatteetaten-no.vitelweb.com/.Skattekortet2024/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.gstatic.com
skatteetaten-no.vitelweb.com
www.google.com
www.gstatic.com
skatteetaten-no.vitelweb.com
198.100.153.84
2a00:1450:4001:811::2003
2a00:1450:4001:828::2003
2a00:1450:4001:82f::2004
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
310b551da8995cd9f846ca018e4d2a015f7218ff98e99066362035db38a9650f
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
476bc35c6c83432d72b1e3ab1fae7d2d5dff644a379d810d17125ababa6f525f
4df8c12e4cb65f016dfc51ce2442a3496d0219756d38ab605809d9341d7a3192
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
6304d9df4df1c8927f12fc5bcf7020b2d992d1e1f9fab5bd985dd55de04fe163
697e7fcf61a6597d600e1f68bf94a254c4b7d9959141ae76a4587b0d05e977b9
7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050
906ec59b66d2f7ce699f959ef8e778061a68e4f0bdadb2a8e51a5435af84e170
9f4e013540428f55b7dcb13425cea8191f66c42cc03346ade5562917e13556a4
a17dfe1c2dfc5c812672215f8466c508bbe9379a2a627f4ddbe22ba5ef8ee665
cdfb561f539e86f53b729e02c12846d6b18970351e48b5305539697e16a9a184
cfab0b5276224f067296f6cf7643514afcee77f051ade7fe9995bbf3e217caa9
d5ebed6cd05cf19136fcc9cae328d2bc7828f564c8b212676fa3385a83eaa89c
d900386109e35c058b7696e4b5eca16bc4fd083dba10de464564e08b69662406
eee0de974dc453065f99ef24913aad33ed87c19841d8b1269786e27378fcb53b
f9a7cb7f5c5e01adc3c733cd2bfa8398abb9c2326342e5a59e04ee40bd639871

skatteetaten-no.vitelweb.com Open in urlscan Pro 198.100.153.84 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Community Verdicts: Malicious — 1 votes Show Verdicts

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

25 Requests

88 %HTTPS

75 %IPv6

3 Domains

4 Subdomains

5 IPs

2 Countries

602 kBTransfer

1666 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

25 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Malicious task.url Submitted on February 6th 2024, 12:05:30 pm UTC — From Norway

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

0 JavaScript Global Variables

2 Cookies

7 Console Messages

Indicators

skatteetaten-no.vitelweb.com Open in urlscan Pro
198.100.153.84 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

25
Requests

88 %
HTTPS

75 %
IPv6

3
Domains

4
Subdomains

5
IPs

2
Countries

602 kB
Transfer

1666 kB
Size

2
Cookies

25 HTTP transactions
0 data transactions

Malicious task.url
Submitted on February 6th 2024, 12:05:30 pm UTC — From Norway

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!