turvallisuus28732-netbank-nordea.net Open in urlscan Pro
81.94.150.147 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://westmonarchlabs.com/wha6p
Effective URL:
https://turvallisuus28732-netbank-nordea.net/28732.php
Submission: On February 19 via manual (February 19th 2024, 10:10:11 am UTC) from FI — Scanned from FI

Summary HTTP 20 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 3 domains to perform 20 HTTP transactions. The main IP is 81.94.150.147, located in Moscow, Russian Federation and belongs to WESTCALL-AS, RU. The main domain is turvallisuus28732-netbank-nordea.net.
TLS certificate: Issued by R3 on February 14th 2024. Valid for: 3 months.

This is the only time turvallisuus28732-netbank-nordea.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Nordea (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	193.3.19.25 193.3.19.25	50340 (SELECTEL-MSK) (SELECTEL-MSK)
19	81.94.150.147 81.94.150.147	8595 (WESTCALL-AS) (WESTCALL-AS)
20	2

1 193.3.19.25 (Russian Federation)

ASN50340 (SELECTEL-MSK, RU)

westmonarchlabs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 81.94.150.147 (Moscow, Russian Federation)

ASN8595 (WESTCALL-AS, RU)

petospalvelu58732-netbank-nordea.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
turvallisuus28732-netbank-nordea.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
18	turvallisuus28732-netbank-nordea.net turvallisuus28732-netbank-nordea.net	217 KB
1	petospalvelu58732-netbank-nordea.com petospalvelu58732-netbank-nordea.com	117 B
1	westmonarchlabs.com westmonarchlabs.com	365 B
20	3

	Domain	Requested by
18	turvallisuus28732-netbank-nordea.net	turvallisuus28732-netbank-nordea.net
1	petospalvelu58732-netbank-nordea.com
1	westmonarchlabs.com
20	3

This site contains no links.

Subject Issuer	Validity	Valid
gimonmsa.com R3	`2024-02-14` - `2024-05-14`	3 months	crt.sh
petospalvelu58732-netbank-nordea.com R3	`2024-02-14` - `2024-05-14`	3 months	crt.sh
turvallisuus28732-netbank-nordea.net R3	`2024-02-14` - `2024-05-14`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://turvallisuus28732-netbank-nordea.net/28732.php
Frame ID: 9A014F31EA9794EE368BD0B56977F612
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Nordea - Tunnistautuminen

Page URL History Show full URLs

https://westmonarchlabs.com/wha6p Page URL
https://turvallisuus28732-netbank-nordea.net/28732.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

20
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

217 kB
Transfer

385 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://westmonarchlabs.com/wha6p Page URL
https://turvallisuus28732-netbank-nordea.net/28732.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

20 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	404 Not Found	wha6p Show response westmonarchlabs.com/	85 B 365 B	307ms 76ms	Document text/html	193.3.19.25 SELECTEL-MSK
General Check archive.org Show headers Download Go to Full URL https://westmonarchlabs.com/wha6p Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 193.3.19.25 , Russian Federation, ASN50340 (SELECTEL-MSK, RU), Reverse DNS Software nginx / Resource Hash `334469e66cb07681ee8a0cce8909879431a0ed39c49b163e8e9e193d63a64ab8` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36 accept-language fi-FI,fi;q=0.9 Response headers Accept-Ranges bytes Connection keep-alive Content-Length 85 Content-Type text/html; charset=UTF-8 Date Mon, 19 Feb 2024 10:10:06 GMT ETag "55-611b522eb93e7" Keep-Alive timeout=60 Last-Modified Mon, 19 Feb 2024 05:12:12 GMT Server nginx
GET H2	200	/ Show response petospalvelu58732-netbank-nordea.com/	0 117 B	892ms 470ms	Document text/html	81.94.150.147 WESTCALL-AS
General Check archive.org Show headers Download Go to Full URL https://petospalvelu58732-netbank-nordea.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 81.94.150.147 Moscow, Russian Federation, ASN8595 (WESTCALL-AS, RU), Reverse DNS Software nginx / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://westmonarchlabs.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36 accept-language fi-FI,fi;q=0.9 Response headers content-length 0 content-type text/html; charset=UTF-8 date Mon, 19 Feb 2024 10:10:07 GMT refresh 0; URL=https://turvallisuus28732-netbank-nordea.net/28732.php server nginx
GET H2	200	Primary Request 28732.php Show response turvallisuus28732-netbank-nordea.net/	25 KB 6 KB	1188ms 497ms	Document text/html	81.94.150.147 WESTCALL-AS
General Check archive.org Show headers Download Go to Full URL https://turvallisuus28732-netbank-nordea.net/28732.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 81.94.150.147 Moscow, Russian Federation, ASN8595 (WESTCALL-AS, RU), Reverse DNS Software nginx / Resource Hash `18a4c13f052ef8ab81dc604cfe1ef72d5795acf3d6f6d1da2a01c9d734198414` Request headers Referer https://petospalvelu58732-netbank-nordea.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36 accept-language fi-FI,fi;q=0.9 Response headers content-encoding gzip content-length 5629 content-type text/html; charset=UTF-8 date Mon, 19 Feb 2024 10:10:08 GMT server nginx vary Accept-Encoding
GET H2	200	style.css turvallisuus28732-netbank-nordea.net/css/	27 KB 5 KB	96ms 95ms	Stylesheet text/css	81.94.150.147 WESTCALL-AS
General Check archive.org Show headers Download Go to Full URL https://turvallisuus28732-netbank-nordea.net/css/style.css Requested by Host: turvallisuus28732-netbank-nordea.net URL: https://turvallisuus28732-netbank-nordea.net/28732.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 81.94.150.147 Moscow, Russian Federation, ASN8595 (WESTCALL-AS, RU), Reverse DNS Software nginx / Resource Hash `05b2dab1c74c37f3d2b356d36e8fc36ad6553afaeb79f98f81db77bbec3aaebf` Request headers accept-language fi-FI,fi;q=0.9 Referer https://turvallisuus28732-netbank-nordea.net/28732.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36 Response headers date Mon, 19 Feb 2024 10:10:08 GMT content-encoding gzip last-modified Mon, 22 Jan 2024 20:03:34 GMT server nginx etag W/"65aeca16-6a43" vary Accept-Encoding content-type text/css cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	jquery-3.6.0.min.js Show response turvallisuus28732-netbank-nordea.net/js/	87 KB 30 KB	137ms 136ms	Script application/javascript	81.94.150.147 WESTCALL-AS
General Check archive.org Show headers Download Go to Full URL https://turvallisuus28732-netbank-nordea.net/js/jquery-3.6.0.min.js Requested by Host: turvallisuus28732-netbank-nordea.net URL: https://turvallisuus28732-netbank-nordea.net/28732.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 81.94.150.147 Moscow, Russian Federation, ASN8595 (WESTCALL-AS, RU), Reverse DNS Software nginx / Resource Hash `ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e` Request headers accept-language fi-FI,fi;q=0.9 Referer https://turvallisuus28732-netbank-nordea.net/28732.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36 Response headers date Mon, 19 Feb 2024 10:10:08 GMT content-encoding gzip last-modified Mon, 22 Jan 2024 20:03:34 GMT server nginx etag W/"65aeca16-15d9d" vary Accept-Encoding content-type application/javascript; charset=utf-8 cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	key.svg turvallisuus28732-netbank-nordea.net/img/	1 KB 895 B	174ms 173ms	Image image/svg+xml	81.94.150.147 WESTCALL-AS
General Check archive.org Show headers Download Go to Show image Full URL https://turvallisuus28732-netbank-nordea.net/img/key.svg Requested by Host: turvallisuus28732-netbank-nordea.net URL: https://turvallisuus28732-netbank-nordea.net/28732.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 81.94.150.147 Moscow, Russian Federation, ASN8595 (WESTCALL-AS, RU), Reverse DNS Software nginx / Resource Hash `b88b6130e6d786e3793f9811c6ad215e23237c3875b1bd85330505dc8ff350f9` Request headers accept-language fi-FI,fi;q=0.9 Referer https://turvallisuus28732-netbank-nordea.net/28732.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36 Response headers date Mon, 19 Feb 2024 10:10:08 GMT content-encoding gzip last-modified Mon, 22 Jan 2024 20:03:34 GMT server nginx etag W/"65aeca16-5a2" vary Accept-Encoding content-type image/svg+xml cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	qr.svg turvallisuus28732-netbank-nordea.net/img/	1 KB 642 B	175ms 174ms	Image image/svg+xml	81.94.150.147 WESTCALL-AS
General Check archive.org Show headers Download Go to Show image Full URL https://turvallisuus28732-netbank-nordea.net/img/qr.svg Requested by Host: turvallisuus28732-netbank-nordea.net URL: https://turvallisuus28732-netbank-nordea.net/28732.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 81.94.150.147 Moscow, Russian Federation, ASN8595 (WESTCALL-AS, RU), Reverse DNS Software nginx / Resource Hash `9dce5d117feaa37a56f57d332e48c012e56e5569dac7cab55a28305587624a24` Request headers accept-language fi-FI,fi;q=0.9 Referer https://turvallisuus28732-netbank-nordea.net/28732.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36 Response headers date Mon, 19 Feb 2024 10:10:08 GMT content-encoding gzip last-modified Mon, 22 Jan 2024 20:03:34 GMT server nginx etag W/"65aeca16-48e" vary Accept-Encoding content-type image/svg+xml cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	second.svg turvallisuus28732-netbank-nordea.net/img/	2 KB 1 KB	104ms 104ms	Image image/svg+xml	81.94.150.147 WESTCALL-AS
General Check archive.org Show headers Download Go to Show image Full URL https://turvallisuus28732-netbank-nordea.net/img/second.svg Requested by Host: turvallisuus28732-netbank-nordea.net URL: https://turvallisuus28732-netbank-nordea.net/28732.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 81.94.150.147 Moscow, Russian Federation, ASN8595 (WESTCALL-AS, RU), Reverse DNS Software nginx / Resource Hash `4bb0667918cd4d97513a0d51d50ed3f3cf4d61ddb35f6319cde294149ebb79ae` Request headers accept-language fi-FI,fi;q=0.9 Referer https://turvallisuus28732-netbank-nordea.net/28732.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36 Response headers date Mon, 19 Feb 2024 10:10:09 GMT content-encoding gzip last-modified Mon, 22 Jan 2024 20:03:34 GMT server nginx etag W/"65aeca16-751" vary Accept-Encoding content-type image/svg+xml cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	private.svg turvallisuus28732-netbank-nordea.net/img/	671 B 850 B	149ms 149ms	Image image/svg+xml	81.94.150.147 WESTCALL-AS
General Check archive.org Show headers Download Go to Show image Full URL https://turvallisuus28732-netbank-nordea.net/img/private.svg Requested by Host: turvallisuus28732-netbank-nordea.net URL: https://turvallisuus28732-netbank-nordea.net/28732.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 81.94.150.147 Moscow, Russian Federation, ASN8595 (WESTCALL-AS, RU), Reverse DNS Software nginx / Resource Hash `23c76e6a9df05e6f95e1384fbf5566300447cf8a2e658af4de19bb52c14eeadf` Request headers accept-language fi-FI,fi;q=0.9 Referer https://turvallisuus28732-netbank-nordea.net/28732.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36 Response headers date Mon, 19 Feb 2024 10:10:09 GMT last-modified Mon, 22 Jan 2024 20:03:34 GMT server nginx etag "65aeca16-29f" content-type image/svg+xml cache-control max-age=315360000 accept-ranges bytes content-length 671 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	id.svg turvallisuus28732-netbank-nordea.net/img/	724 B 903 B	136ms 134ms	Image image/svg+xml	81.94.150.147 WESTCALL-AS
General Check archive.org Show headers Download Go to Show image Full URL https://turvallisuus28732-netbank-nordea.net/img/id.svg Requested by Host: turvallisuus28732-netbank-nordea.net URL: https://turvallisuus28732-netbank-nordea.net/28732.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 81.94.150.147 Moscow, Russian Federation, ASN8595 (WESTCALL-AS, RU), Reverse DNS Software nginx / Resource Hash `c137f1432d58dec0f7fde518cf820bd45ffb9473b662f60d09ff676c29c1ecf7` Request headers accept-language fi-FI,fi;q=0.9 Referer https://turvallisuus28732-netbank-nordea.net/28732.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36 Response headers date Mon, 19 Feb 2024 10:10:09 GMT last-modified Mon, 22 Jan 2024 20:03:34 GMT server nginx etag "65aeca16-2d4" content-type image/svg+xml cache-control max-age=315360000 accept-ranges bytes content-length 724 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	call.svg turvallisuus28732-netbank-nordea.net/img/	2 KB 993 B	174ms 173ms	Image image/svg+xml	81.94.150.147 WESTCALL-AS
General Check archive.org Show headers Download Go to Show image Full URL https://turvallisuus28732-netbank-nordea.net/img/call.svg Requested by Host: turvallisuus28732-netbank-nordea.net URL: https://turvallisuus28732-netbank-nordea.net/28732.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 81.94.150.147 Moscow, Russian Federation, ASN8595 (WESTCALL-AS, RU), Reverse DNS Software nginx / Resource Hash `149f14aeb591d3b4c7e8b7b0260a13a97740770ee8dc1aef42493136d11789dc` Request headers accept-language fi-FI,fi;q=0.9 Referer https://turvallisuus28732-netbank-nordea.net/28732.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36 Response headers date Mon, 19 Feb 2024 10:10:09 GMT content-encoding gzip last-modified Mon, 22 Jan 2024 20:03:34 GMT server nginx etag W/"65aeca16-72e" vary Accept-Encoding content-type image/svg+xml cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	attach.js Show response turvallisuus28732-netbank-nordea.net/js/	101 KB 37 KB	139ms 137ms	Script application/javascript	81.94.150.147 WESTCALL-AS
General Check archive.org Show headers Download Go to Full URL https://turvallisuus28732-netbank-nordea.net/js/attach.js Requested by Host: turvallisuus28732-netbank-nordea.net URL: https://turvallisuus28732-netbank-nordea.net/28732.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 81.94.150.147 Moscow, Russian Federation, ASN8595 (WESTCALL-AS, RU), Reverse DNS Software nginx / Resource Hash `691afc622eb87eaf75802e007e7632ac2bba47e0a87d22bd3ecb80f2cf1c4ae8` Request headers accept-language fi-FI,fi;q=0.9 Referer https://turvallisuus28732-netbank-nordea.net/28732.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36 Response headers date Mon, 19 Feb 2024 10:10:09 GMT content-encoding gzip last-modified Mon, 22 Jan 2024 20:04:34 GMT server nginx etag W/"65aeca52-192ea" vary Accept-Encoding content-type application/javascript; charset=utf-8 cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	api.js Show response turvallisuus28732-netbank-nordea.net/js/	5 KB 2 KB	148ms 147ms	Script application/javascript	81.94.150.147 WESTCALL-AS
General Check archive.org Show headers Download Go to Full URL https://turvallisuus28732-netbank-nordea.net/js/api.js Requested by Host: turvallisuus28732-netbank-nordea.net URL: https://turvallisuus28732-netbank-nordea.net/28732.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 81.94.150.147 Moscow, Russian Federation, ASN8595 (WESTCALL-AS, RU), Reverse DNS Software nginx / Resource Hash `40288c2bc2c652b0bd2ffada9032fef3211d39719d10b9ef8ff96c74f8b0da5e` Request headers accept-language fi-FI,fi;q=0.9 Referer https://turvallisuus28732-netbank-nordea.net/28732.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36 Response headers date Mon, 19 Feb 2024 10:10:09 GMT content-encoding gzip last-modified Mon, 22 Jan 2024 20:03:34 GMT server nginx etag W/"65aeca16-150e" vary Accept-Encoding content-type application/javascript; charset=utf-8 cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	app.js Show response turvallisuus28732-netbank-nordea.net/js/	1 KB 678 B	170ms 169ms	Script application/javascript	81.94.150.147 WESTCALL-AS
General Check archive.org Show headers Download Go to Full URL https://turvallisuus28732-netbank-nordea.net/js/app.js Requested by Host: turvallisuus28732-netbank-nordea.net URL: https://turvallisuus28732-netbank-nordea.net/28732.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 81.94.150.147 Moscow, Russian Federation, ASN8595 (WESTCALL-AS, RU), Reverse DNS Software nginx / Resource Hash `6ebef8143826d0523fa72fd34033be6fc0372d39f46d732b54d4652152af3d4b` Request headers accept-language fi-FI,fi;q=0.9 Referer https://turvallisuus28732-netbank-nordea.net/28732.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36 Response headers date Mon, 19 Feb 2024 10:10:09 GMT content-encoding gzip last-modified Mon, 22 Jan 2024 20:03:34 GMT server nginx etag W/"65aeca16-5b7" vary Accept-Encoding content-type application/javascript; charset=utf-8 cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	call.js Show response turvallisuus28732-netbank-nordea.net/js/	3 KB 1015 B	171ms 170ms	Script application/javascript	81.94.150.147 WESTCALL-AS
General Check archive.org Show headers Download Go to Full URL https://turvallisuus28732-netbank-nordea.net/js/call.js Requested by Host: turvallisuus28732-netbank-nordea.net URL: https://turvallisuus28732-netbank-nordea.net/28732.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 81.94.150.147 Moscow, Russian Federation, ASN8595 (WESTCALL-AS, RU), Reverse DNS Software nginx / Resource Hash `c0c46871093304af7b63809dfd73fbe51c0bdd7a00133d6b4bde3a55373ba005` Request headers accept-language fi-FI,fi;q=0.9 Referer https://turvallisuus28732-netbank-nordea.net/28732.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36 Response headers date Mon, 19 Feb 2024 10:10:09 GMT content-encoding gzip last-modified Mon, 19 Feb 2024 09:32:03 GMT server nginx etag W/"65d32013-c69" vary Accept-Encoding content-type application/javascript; charset=utf-8 cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	bg3.jpg turvallisuus28732-netbank-nordea.net/img/	67 KB 67 KB	172ms 172ms	Image image/jpeg	81.94.150.147 WESTCALL-AS
General Check archive.org Show headers Download Go to Show image Full URL https://turvallisuus28732-netbank-nordea.net/img/bg3.jpg Requested by Host: turvallisuus28732-netbank-nordea.net URL: https://turvallisuus28732-netbank-nordea.net/css/style.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 81.94.150.147 Moscow, Russian Federation, ASN8595 (WESTCALL-AS, RU), Reverse DNS Software nginx / Resource Hash `836393ac52708bd75b2e1c88defb51faa58f0fdfa374d57d2529e0a6554882ff` Request headers accept-language fi-FI,fi;q=0.9 Referer https://turvallisuus28732-netbank-nordea.net/css/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36 Response headers date Mon, 19 Feb 2024 10:10:09 GMT last-modified Mon, 22 Jan 2024 20:03:34 GMT server nginx etag "65aeca16-10b43" content-type image/jpeg cache-control max-age=315360000 accept-ranges bytes content-length 68419 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	thenordius.woff turvallisuus28732-netbank-nordea.net/font/	30 KB 31 KB	183ms 183ms	Font font/woff	81.94.150.147 WESTCALL-AS
General Check archive.org Show headers Download Go to Full URL https://turvallisuus28732-netbank-nordea.net/font/thenordius.woff Requested by Host: turvallisuus28732-netbank-nordea.net URL: https://turvallisuus28732-netbank-nordea.net/css/style.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 81.94.150.147 Moscow, Russian Federation, ASN8595 (WESTCALL-AS, RU), Reverse DNS Software nginx / Resource Hash `21a2a17b532837aeafeb95de9f252bfec714028517f79fb4143845ca4d23353c` Request headers Referer https://turvallisuus28732-netbank-nordea.net/css/style.css Origin https://turvallisuus28732-netbank-nordea.net accept-language fi-FI,fi;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36 Response headers date Mon, 19 Feb 2024 10:10:09 GMT last-modified Mon, 22 Jan 2024 20:03:34 GMT server nginx etag "65aeca16-79b0" content-type font/woff cache-control max-age=315360000 accept-ranges bytes content-length 31152 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	noradno.woff turvallisuus28732-netbank-nordea.net/font/	31 KB 31 KB	206ms 206ms	Font font/woff	81.94.150.147 WESTCALL-AS
General Check archive.org Show headers Download Go to Full URL https://turvallisuus28732-netbank-nordea.net/font/noradno.woff Requested by Host: turvallisuus28732-netbank-nordea.net URL: https://turvallisuus28732-netbank-nordea.net/css/style.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 81.94.150.147 Moscow, Russian Federation, ASN8595 (WESTCALL-AS, RU), Reverse DNS Software nginx / Resource Hash `ff28a732b1fc6a547797b7a9a7c29025ae41b74cc5e208232418d9c41fb43c44` Request headers Referer https://turvallisuus28732-netbank-nordea.net/css/style.css Origin https://turvallisuus28732-netbank-nordea.net accept-language fi-FI,fi;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36 Response headers date Mon, 19 Feb 2024 10:10:09 GMT last-modified Mon, 22 Jan 2024 20:03:34 GMT server nginx etag "65aeca16-7c1c" content-type font/woff cache-control max-age=315360000 accept-ranges bytes content-length 31772 expires Thu, 31 Dec 2037 23:55:55 GMT
POST H2	200	action.php Show response turvallisuus28732-netbank-nordea.net/api/	2 B 278 B	99ms 99ms	XHR text/html	81.94.150.147 WESTCALL-AS
General Check archive.org Show headers Download Go to Full URL https://turvallisuus28732-netbank-nordea.net/api/action.php Requested by Host: turvallisuus28732-netbank-nordea.net URL: https://turvallisuus28732-netbank-nordea.net/js/jquery-3.6.0.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 81.94.150.147 Moscow, Russian Federation, ASN8595 (WESTCALL-AS, RU), Reverse DNS Software nginx / Resource Hash `565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3` Request headers Accept / Referer https://turvallisuus28732-netbank-nordea.net/28732.php X-Requested-With XMLHttpRequest accept-language fi-FI,fi;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers pragma no-cache date Mon, 19 Feb 2024 10:10:09 GMT content-encoding gzip server nginx vary Accept-Encoding content-type text/html; charset=UTF-8 access-control-allow-origin * cache-control no-store, no-cache, must-revalidate content-length 22 expires Thu, 19 Nov 1981 08:52:00 GMT
GET H2	200	event.php Show response turvallisuus28732-netbank-nordea.net/api/	6 B 233 B	96ms 96ms	XHR application/json	81.94.150.147 WESTCALL-AS
General Check archive.org Show headers Download Go to Full URL https://turvallisuus28732-netbank-nordea.net/api/event.php Requested by Host: turvallisuus28732-netbank-nordea.net URL: https://turvallisuus28732-netbank-nordea.net/js/jquery-3.6.0.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 81.94.150.147 Moscow, Russian Federation, ASN8595 (WESTCALL-AS, RU), Reverse DNS Software nginx / Resource Hash `551564ffd31b0ee952048003a73a052ce652f814fa50b60f0f5b439dbb76fd1b` Request headers Accept / Referer https://turvallisuus28732-netbank-nordea.net/28732.php X-Requested-With XMLHttpRequest accept-language fi-FI,fi;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36 Response headers pragma no-cache date Mon, 19 Feb 2024 10:10:10 GMT content-encoding gzip server nginx vary Accept-Encoding content-type application/json; charset=utf-8 access-control-allow-origin * cache-control no-store, no-cache, must-revalidate expires Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Nordea (Banking)

48 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			turvallisuus28732-netbank-nordea.net/	1969-12-31 23:59:59	Name: PHPSESSID Value: cr10kv0qt400nl5a80njmjseam

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://westmonarchlabs.com/wha6p Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

petospalvelu58732-netbank-nordea.com
turvallisuus28732-netbank-nordea.net
westmonarchlabs.com
193.3.19.25
81.94.150.147
05b2dab1c74c37f3d2b356d36e8fc36ad6553afaeb79f98f81db77bbec3aaebf
149f14aeb591d3b4c7e8b7b0260a13a97740770ee8dc1aef42493136d11789dc
18a4c13f052ef8ab81dc604cfe1ef72d5795acf3d6f6d1da2a01c9d734198414
21a2a17b532837aeafeb95de9f252bfec714028517f79fb4143845ca4d23353c
23c76e6a9df05e6f95e1384fbf5566300447cf8a2e658af4de19bb52c14eeadf
334469e66cb07681ee8a0cce8909879431a0ed39c49b163e8e9e193d63a64ab8
40288c2bc2c652b0bd2ffada9032fef3211d39719d10b9ef8ff96c74f8b0da5e
4bb0667918cd4d97513a0d51d50ed3f3cf4d61ddb35f6319cde294149ebb79ae
551564ffd31b0ee952048003a73a052ce652f814fa50b60f0f5b439dbb76fd1b
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
691afc622eb87eaf75802e007e7632ac2bba47e0a87d22bd3ecb80f2cf1c4ae8
6ebef8143826d0523fa72fd34033be6fc0372d39f46d732b54d4652152af3d4b
836393ac52708bd75b2e1c88defb51faa58f0fdfa374d57d2529e0a6554882ff
9dce5d117feaa37a56f57d332e48c012e56e5569dac7cab55a28305587624a24
b88b6130e6d786e3793f9811c6ad215e23237c3875b1bd85330505dc8ff350f9
c0c46871093304af7b63809dfd73fbe51c0bdd7a00133d6b4bde3a55373ba005
c137f1432d58dec0f7fde518cf820bd45ffb9473b662f60d09ff676c29c1ecf7
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
ff28a732b1fc6a547797b7a9a7c29025ae41b74cc5e208232418d9c41fb43c44

turvallisuus28732-netbank-nordea.net Open in urlscan Pro 81.94.150.147 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

20 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

2 IPs

1 Countries

217 kBTransfer

385 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

20 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

48 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

turvallisuus28732-netbank-nordea.net Open in urlscan Pro
81.94.150.147 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

20
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

217 kB
Transfer

385 kB
Size

1
Cookies

20 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!