nordea.secure294.com
Open in
urlscan Pro
185.247.184.10
Malicious Activity!
Public Scan
Submitted URL: http://nordea.secure294.com/privat
Effective URL: https://nordea.secure294.com/privat
Submission: On March 07 via manual from SE — Scanned from SE
Effective URL: https://nordea.secure294.com/privat
Submission: On March 07 via manual from SE — Scanned from SE
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 8 HTTP transactions.
The main IP is 185.247.184.10, located in
Rome, Italy and
belongs to GIR-AS, RU.
The main domain is nordea.secure294.com.
TLS certificate: Issued by R3 on March 6th 2023. Valid for: 3 months.
This is the only time nordea.secure294.com was scanned on urlscan.io!
TLS certificate: Issued by R3 on March 6th 2023. Valid for: 3 months.
This is the only time nordea.secure294.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Nordea (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 9 | 185.247.184.10 185.247.184.10 | 207713 (GIR-AS) (GIR-AS) | |
| 8 | 1 |
9
185.247.184.10
(Rome, Italy)
ASN207713 (GIR-AS, RU)
PTR: 4SER-1676559442.ip-ptr.tech
ASN207713 (GIR-AS, RU)
PTR: 4SER-1676559442.ip-ptr.tech
| nordea.secure294.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 9 |
secure294.com
1 redirects
nordea.secure294.com |
143 KB |
| 8 | 1 |
| Domain | Requested by | |
|---|---|---|
| 9 | nordea.secure294.com |
1 redirects
nordea.secure294.com
|
| 8 | 1 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| nordea.secure294.com R3 |
2023-03-06 - 2023-06-04 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://nordea.secure294.com/privat
Frame ID: 466A01BD7A0432687FC918D60E9EECB7
Requests: 8 HTTP requests in this frame
Screenshot
Page Title
Förnya Mobilt BankID - NordeaPage URL History Show full URLs
-
http://nordea.secure294.com/privat
HTTP 301
https://nordea.secure294.com/privat Page URL
Detected technologies
Laravel
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://nordea.secure294.com/privat
HTTP 301
https://nordea.secure294.com/privat Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
privat
nordea.secure294.com/ Redirect Chain
|
6 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
app.css
nordea.secure294.com/css/nordea/ |
12 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bankid.svg
nordea.secure294.com/images/ |
3 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
card_reader.svg
nordea.secure294.com/images/nordea/ |
891 B 673 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
qr_reader.svg
nordea.secure294.com/images/nordea/ |
642 B 561 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
app.js
nordea.secure294.com/js/nordea/ |
215 KB 67 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bg-top.png
nordea.secure294.com/images/ |
39 KB 40 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
7bc117ce8cbf2ce4b08a7ed17d16cf89.woff2
nordea.secure294.com/fonts/nordea/ |
26 KB 26 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Nordea (Banking)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless string| userFlow function| axios object| QRCode object| Alpine function| Vue2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| nordea.secure294.com/ | Name: XSRF-TOKEN Value: eyJpdiI6ImY5VGNJWjJxYWYzdDMzMVBSS0s3cUE9PSIsInZhbHVlIjoiUEp3K2dBS3pHd3JhVDdGSHpyNzRrNjB4N24xbm9JNGFFbmw4TTVjU01LdTVIRnY1cjkvUnUrd2lvQ0wreFRVTXQrdlAzUHB5UlRYUVlEYVRQdzJQOHNvc3BkTDNDbE9idjA4dzUxQmtYN3RqUXB6K2FVWVlyRC9lOVNTaDZnL3ciLCJtYWMiOiIwNjZhYzZkNGU1NDY5ZjMyMTQ0YzdkOTA0ZDI1OTE2YWE4NmM2YTI4ZjZjY2MxNzNmNzhmNjQ3M2IwYTI0MTI4IiwidGFnIjoiIn0%3D |
|
| nordea.secure294.com/ | Name: laravel_session Value: eyJpdiI6IjM0MDdrQ1dHaGZpQVlDVzZhVFVoMFE9PSIsInZhbHVlIjoiYmx5SERVRXRxdFd2ekQ1NE9lTlkxeHFQNlF0SENGKytrYWxpWTRlV3hFa0dNYVJVNm4xdXlPVWNWUFRuSmNKaG83RXYyRVhHZzZDWnV1bGtRaDBRMXpWMzdwMkVGZWhDUGlXSVZydHFLWXQwekJnSjRmZ2x1TzArSDJEcDFqSjIiLCJtYWMiOiJmYTc2NzI2MDg4YTBlMjcyZjZmMzMyMTZkODczMDc0MzliYTFmMjliMjNhYTlkYzZjNmVhYTM4ZGE5NjJiNTAwIiwidGFnIjoiIn0%3D |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| X-Content-Type-Options | nosniff |
| X-Frame-Options | SAMEORIGIN |
| X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
nordea.secure294.com
185.247.184.10
02f83a5b9399a138bd6017bb0c2e5f2924f0e36799324e7e4f4f517130939952
0b76503946c6f19f7150b0950f704eac5cb94842b7698ea8eb9b0d4372b1bd05
9fc5b5c44107cfc6701be07fa5d5a4d7ab066607dd7ab6e9f396ac709e28424f
a93f6086756b2a2e94db8aaf795faab950a315cd9a8e32c5b0df707636dedfff
af1eadde5664e5d1de755b21881b3b734f1e9c0c8570f9684bd1d02bc744b7df
b34c9039b5f92575e57676734ec42dd908ef1877fe59a4d55b4277db69663830
ce22eb0c405b78a4247ec19eba5816e03a01a3c065e84a2bc58a23875cd1efc7
d01b21b18f42e608dc8b7a9e6bf7a9cffa2d260bd002fb0f9aba8d3a967cbfd4