skatteetateneu.wpenginepowered.com Open in urlscan Pro
141.193.213.10 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://skatteetateneu.wpenginepowered.com/no/id/acp.html
Submission: On December 11 via manual (December 11th 2024, 9:45:21 am UTC) from NO — Scanned from NO

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 13 HTTP transactions. The main IP is 141.193.213.10, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare London, LLC, US. The main domain is skatteetateneu.wpenginepowered.com.
TLS certificate: Issued by E6 on November 16th 2024. Valid for: 3 months.

This is the only time skatteetateneu.wpenginepowered.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BankID (Banking)

Domain & IP information

	IP Address	AS Autonomous System
11	141.193.213.10 141.193.213.10	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare London)
1	142.250.185.170 142.250.185.170	15169 (GOOGLE) (GOOGLE)
1	95.175.105.204 95.175.105.204	49282 (FICOLO Fi...) (FICOLO Ficolo Oy)
13	3

11 141.193.213.10 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US)

skatteetateneu.wpenginepowered.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.170 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f10.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 95.175.105.204 (Helsinki, Finland)

ASN49282 (FICOLO Ficolo Oy, FI)
PTR: kommunikasjon.ntb.no

kommunikasjon.ntb.no	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	wpenginepowered.com skatteetateneu.wpenginepowered.com	36 KB
1	ntb.no kommunikasjon.ntb.no	6 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 29	1 KB
13	3

	Domain	Requested by
11	skatteetateneu.wpenginepowered.com	skatteetateneu.wpenginepowered.com
1	kommunikasjon.ntb.no
1	fonts.googleapis.com	skatteetateneu.wpenginepowered.com
13	3

This site contains no links.

Subject Issuer	Validity	Valid
wpenginepowered.com E6	`2024-11-16` - `2025-02-14`	3 months	crt.sh
upload.video.google.com WR2	`2024-11-04` - `2025-01-27`	3 months	crt.sh
kommunikasjon.ntb.no R10	`2024-10-28` - `2025-01-26`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://skatteetateneu.wpenginepowered.com/no/id/acp.html
Frame ID: 827E405CE4E7C74CFD9D1C45858305AD
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

NORGE AS

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

13
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

43 kB
Transfer

234 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 Primary Request acp.html Show response
skatteetateneu.wpenginepowered.com/no/id/ 4 KB
1 KB 1121ms
1000ms Document
text/html 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://skatteetateneu.wpenginepowered.com/no/id/acp.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d67c75de16aa03e74d540557e9f1860ce843dda299b296a31c8470162d03d094

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: max-age=600, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 8f048a576edeac1d-GOT
content-encoding: br
content-type: text/html
date: Wed, 11 Dec 2024 09:45:12 GMT
last-modified: Wed, 11 Dec 2024 09:15:51 GMT
priority: u=0,i
server: cloudflare
server-timing: cfExtPri
vary: Accept-Encoding Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
x-cache: MISS
x-cache-group: iphone
x-cacheable: SHORT

GET
H3 200 bootstrap.css
skatteetateneu.wpenginepowered.com/no/id/css/ 189 KB
26 KB 858ms
858ms Stylesheet
text/css 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://skatteetateneu.wpenginepowered.com/no/id/css/bootstrap.css
Requested by: Host: skatteetateneu.wpenginepowered.com
URL: https://skatteetateneu.wpenginepowered.com/no/id/acp.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 823d30ccfd5ba5d3e5c1efbd67b15390d49d8e0b4cfb36335057821778686917

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://skatteetateneu.wpenginepowered.com/no/id/acp.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: MISS
etag: W/"67595847-2f22a"
cf-ray: 8f048a5dbf37ac1d-GOT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 11 Dec 2024 09:45:13 GMT
content-type: text/css
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare
last-modified: Wed, 11 Dec 2024 09:15:51 GMT
priority: u=0,i=?0

GET
H3 200 lary.css
skatteetateneu.wpenginepowered.com/no/id/css/ 10 KB
2 KB 805ms
805ms Stylesheet
text/css 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://skatteetateneu.wpenginepowered.com/no/id/css/lary.css
Requested by: Host: skatteetateneu.wpenginepowered.com
URL: https://skatteetateneu.wpenginepowered.com/no/id/acp.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 26b09af686038eff10a161b0e3b88d0c311b829aee42126ca1d915a48018d8c6

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://skatteetateneu.wpenginepowered.com/no/id/acp.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: MISS
etag: W/"67595847-279f"
cf-ray: 8f048a5dbf38ac1d-GOT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 11 Dec 2024 09:45:13 GMT
content-type: text/css
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare
last-modified: Wed, 11 Dec 2024 09:15:51 GMT
priority: u=0,i=?0

GET
H3 200 acc.svg
skatteetateneu.wpenginepowered.com/no/id/image/ 2 KB
973 B 745ms
744ms Image
image/svg+xml 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://skatteetateneu.wpenginepowered.com/no/id/image/acc.svg
Requested by: Host: skatteetateneu.wpenginepowered.com
URL: https://skatteetateneu.wpenginepowered.com/no/id/acp.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2135db17253f889e03a392ec096f45b3a79cdb97b498841a698b2bf4a54e1bb4

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://skatteetateneu.wpenginepowered.com/no/id/acp.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: MISS
etag: W/"67595847-824"
cf-ray: 8f048a5dbf3cac1d-GOT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 11 Dec 2024 09:45:13 GMT
content-type: image/svg+xml
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare
last-modified: Wed, 11 Dec 2024 09:15:51 GMT
priority: u=2,i

GET
H3 200 bar_lg.png
skatteetateneu.wpenginepowered.com/no/id/image/ 884 B
1 KB 768ms
768ms Image
image/png 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://skatteetateneu.wpenginepowered.com/no/id/image/bar_lg.png
Requested by: Host: skatteetateneu.wpenginepowered.com
URL: https://skatteetateneu.wpenginepowered.com/no/id/acp.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c7c507bb71038107ffbef4f6b8f3e6b636ca8303e9221ea8322643443a929bf5

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://skatteetateneu.wpenginepowered.com/no/id/acp.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

server: cloudflare
cache-control: public, max-age=31536000
cf-cache-status: MISS
etag: "67595847-374"
cf-ray: 8f048a5dcf44ac1d-GOT
accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 884
server-timing: cfExtPri
date: Wed, 11 Dec 2024 09:45:13 GMT
content-type: image/png
last-modified: Wed, 11 Dec 2024 09:15:51 GMT
vary: Accept-Encoding
priority: u=2,i

GET
H3 200 info.svg
skatteetateneu.wpenginepowered.com/no/id/image/ 760 B
704 B 824ms
823ms Image
image/svg+xml 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://skatteetateneu.wpenginepowered.com/no/id/image/info.svg
Requested by: Host: skatteetateneu.wpenginepowered.com
URL: https://skatteetateneu.wpenginepowered.com/no/id/acp.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7f766030e9de9c68acdacfc671963f8cd00ba8783fc9c25e1d3f3319ebbecbd1

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://skatteetateneu.wpenginepowered.com/no/id/acp.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: MISS
etag: W/"67595847-2f8"
cf-ray: 8f048a628cc8ac1d-GOT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 11 Dec 2024 09:45:14 GMT
content-type: image/svg+xml
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare
last-modified: Wed, 11 Dec 2024 09:15:51 GMT
priority: u=2,i

GET
H3 200 loading.gif
skatteetateneu.wpenginepowered.com/no/id/image/ 898 B
1 KB 949ms
949ms Image
image/gif 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://skatteetateneu.wpenginepowered.com/no/id/image/loading.gif
Requested by: Host: skatteetateneu.wpenginepowered.com
URL: https://skatteetateneu.wpenginepowered.com/no/id/acp.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7e2036b1455c31bd42d2ad4334698ff9108f7eae94274fa6700df6f13656813f

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://skatteetateneu.wpenginepowered.com/no/id/acp.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

server: cloudflare
cache-control: public, max-age=31536000
cf-cache-status: MISS
etag: "67595844-382"
cf-ray: 8f048a629ce3ac1d-GOT
accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 898
server-timing: cfExtPri
date: Wed, 11 Dec 2024 09:45:14 GMT
content-type: image/gif
last-modified: Wed, 11 Dec 2024 09:15:48 GMT
vary: Accept-Encoding
priority: u=2,i

GET
H3 200 protege.png
skatteetateneu.wpenginepowered.com/no/id/image/ 2 KB
3 KB 78ms
77ms Image
image/png 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://skatteetateneu.wpenginepowered.com/no/id/image/protege.png
Requested by: Host: skatteetateneu.wpenginepowered.com
URL: https://skatteetateneu.wpenginepowered.com/no/id/acp.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 375aa9cbfaf03a02679363d4967f662930ea9eb9bc7e75e1ae50e5bd105844fc

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://skatteetateneu.wpenginepowered.com/no/id/acp.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cf-bgj: imgq:100,h2pri
etag: "67595844-12f5"
age: 0
cf-cache-status: HIT
cf-polished: origSize=4853, status=webp_bigger
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 11 Dec 2024 09:45:14 GMT
content-type: image/png
last-modified: Wed, 11 Dec 2024 09:15:48 GMT
vary: Accept-Encoding
priority: u=2,i
cache-control: public, max-age=31536000
cf-ray: 8f048a679c1bac1d-GOT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 2381
server: cloudflare

GET
H3 404 jquery-3.5.1.min.js
skatteetateneu.wpenginepowered.com/no/id/js/ 0
0 82ms
77ms Script
text/html 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://skatteetateneu.wpenginepowered.com/no/id/js/jquery-3.5.1.min.js
Requested by: Host: skatteetateneu.wpenginepowered.com
URL: https://skatteetateneu.wpenginepowered.com/no/id/acp.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://skatteetateneu.wpenginepowered.com/no/id/acp.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
cf-cache-status: HIT
age: 1
cf-ray: 8f048a67eca3ac1d-GOT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 11 Dec 2024 09:45:14 GMT
content-type: text/html
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare
priority: u=2,i=?0

GET
H3 404 jquery.mask.js
skatteetateneu.wpenginepowered.com/no/id/js/ 0
0 90ms
83ms Script
text/html 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://skatteetateneu.wpenginepowered.com/no/id/js/jquery.mask.js
Requested by: Host: skatteetateneu.wpenginepowered.com
URL: https://skatteetateneu.wpenginepowered.com/no/id/acp.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://skatteetateneu.wpenginepowered.com/no/id/acp.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
cf-cache-status: HIT
age: 1
cf-ray: 8f048a67eca6ac1d-GOT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 11 Dec 2024 09:45:14 GMT
content-type: text/html
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare
priority: u=2,i=?0

GET
H2 200 css2
fonts.googleapis.com/ 19 KB
1 KB 778ms
98ms Stylesheet
text/css 142.250.185.170
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Wix+Madefor+Text:ital,wght@0,400;0,500;0,600;0,700;0,800;1,400;1,500;1,600;1,700;1,800&display=swap

Requested by

Host: skatteetateneu.wpenginepowered.com
URL: https://skatteetateneu.wpenginepowered.com/no/id/css/lary.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.170 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f10.1e100.net

Software

ESF /

Resource Hash

af149a3bd3453977e6a908a2375f1c012bb8cff3de05709af5b0bb1a5c9e7506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://skatteetateneu.wpenginepowered.com/
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Wed, 11 Dec 2024 09:45:14 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 11 Dec 2024 09:45:14 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Wed, 11 Dec 2024 09:45:14 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 95f3a80b-ceb5-4afb-9e0a-d1611744ba4d-w_300_h_250.jpg
kommunikasjon.ntb.no/data/images/00306/ 6 KB
6 KB 530ms
71ms Other
image/jpeg 95.175.105.204
FICOLO Ficolo Oy

General

Check archive.org

Show headers Download Go to

Full URL

https://kommunikasjon.ntb.no/data/images/00306/95f3a80b-ceb5-4afb-9e0a-d1611744ba4d-w_300_h_250.jpg

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.175.105.204 Helsinki, Finland, ASN49282 (FICOLO Ficolo Oy, FI),

Reverse DNS

kommunikasjon.ntb.no

Software

nginx /

Resource Hash

425b9ac25db41d127ce9ec8871f06cfbfdefbca4e9c91f1dc401e9ec3cebdddd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://skatteetateneu.wpenginepowered.com/
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
referrer-policy: strict-origin-when-cross-origin
cache-control: max-age=2592000
etag: W/"12533788021"
access-control-allow-methods: POST, PUT, GET, DELETE, OPTIONS
x-prs-image-width: 208
expires: Fri, 10 Jan 2025 09:45:14 GMT
access-control-allow-origin: https://kommunikasjon.ntb.no
content-length: 5707
date: Wed, 11 Dec 2024 09:45:14 GMT
content-type: image/jpeg
server: nginx
x-prs-image-height: 250
access-control-allow-headers: Accept, Accept-Language, Content-Language, Content-Type, Origin

GET
H3 404 favicon.20f0cd89.ico
skatteetateneu.wpenginepowered.com/no/source/ 548 B
326 B 768ms
767ms Other
text/html 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://skatteetateneu.wpenginepowered.com/no/source/favicon.20f0cd89.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://skatteetateneu.wpenginepowered.com/no/id/acp.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
cf-cache-status: MISS
cf-ray: 8f048a6c4a0dac1d-GOT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 11 Dec 2024 09:45:15 GMT
content-type: text/html
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare
priority: u=1,i

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BankID (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://skatteetateneu.wpenginepowered.com/no/id/js/jquery-3.5.1.min.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://skatteetateneu.wpenginepowered.com/no/id/js/jquery.mask.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://skatteetateneu.wpenginepowered.com/no/source/favicon.20f0cd89.ico Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
kommunikasjon.ntb.no
skatteetateneu.wpenginepowered.com
141.193.213.10
142.250.185.170
95.175.105.204
2135db17253f889e03a392ec096f45b3a79cdb97b498841a698b2bf4a54e1bb4
26b09af686038eff10a161b0e3b88d0c311b829aee42126ca1d915a48018d8c6
375aa9cbfaf03a02679363d4967f662930ea9eb9bc7e75e1ae50e5bd105844fc
425b9ac25db41d127ce9ec8871f06cfbfdefbca4e9c91f1dc401e9ec3cebdddd
7e2036b1455c31bd42d2ad4334698ff9108f7eae94274fa6700df6f13656813f
7f766030e9de9c68acdacfc671963f8cd00ba8783fc9c25e1d3f3319ebbecbd1
823d30ccfd5ba5d3e5c1efbd67b15390d49d8e0b4cfb36335057821778686917
af149a3bd3453977e6a908a2375f1c012bb8cff3de05709af5b0bb1a5c9e7506
c7c507bb71038107ffbef4f6b8f3e6b636ca8303e9221ea8322643443a929bf5
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090
d67c75de16aa03e74d540557e9f1860ce843dda299b296a31c8470162d03d094

skatteetateneu.wpenginepowered.com Open in urlscan Pro 141.193.213.10 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

43 kBTransfer

234 kBSize

0 Cookies

0 Outgoing links

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

3 Console Messages

Indicators

skatteetateneu.wpenginepowered.com Open in urlscan Pro
141.193.213.10 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

43 kB
Transfer

234 kB
Size

0
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!