ait-innboks.at
Open in
urlscan Pro
82.221.136.24
Malicious Activity!
Public Scan
Effective URL: https://ait-innboks.at/
Submission: On October 08 via manual from NO — Scanned from AT
Summary
TLS certificate: Issued by R10 on October 7th 2024. Valid for: 3 months.
This is the only time ait-innboks.at was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: BankID (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 2 | 104.26.8.129 104.26.8.129 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 82.221.136.24 82.221.136.24 | 50613 (THORDC-AS) (THORDC-AS) | |
1 | 2 |
ASN50613 (THORDC-AS, IS)
PTR: hekla.orangewebsite.com
ait-innboks.at |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
shorturl.at
2 redirects
shorturl.at — Cisco Umbrella Rank: 62614 www.shorturl.at — Cisco Umbrella Rank: 70152 |
1 KB |
1 |
ait-innboks.at
ait-innboks.at |
24 KB |
1 | 2 |
Domain | Requested by | |
---|---|---|
1 | ait-innboks.at | |
1 | www.shorturl.at | 1 redirects |
1 | shorturl.at | 1 redirects |
1 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
ait-innboks.at R10 |
2024-10-07 - 2025-01-05 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://ait-innboks.at/
Frame ID: 1F6F53DF0BE65265CC09149C1404C34F
Requests: 2 HTTP requests in this frame
Screenshot
Page Title
OIDC ClientPage URL History Show full URLs
-
http://shorturl.at/uUrSa
HTTP 307
https://shorturl.at/uUrSa HTTP 301
https://www.shorturl.at/uUrSa HTTP 302
https://ait-innboks.at/ Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://shorturl.at/uUrSa
HTTP 307
https://shorturl.at/uUrSa HTTP 301
https://www.shorturl.at/uUrSa HTTP 302
https://ait-innboks.at/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
1 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
ait-innboks.at/ Redirect Chain
|
90 KB 24 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: BankID (Banking)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| savepage_ShadowLoader function| validateForm1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
ait-innboks.at/ | Name: PHPSESSID Value: 73f8a84eee0a87e62d09b4c71f201476 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ait-innboks.at
shorturl.at
www.shorturl.at
104.26.8.129
82.221.136.24
398a443cb34a3572105c8de21e68246e017c56ce8f6e5b8444212336374c75c7
f9e8bdb5e8c3549c2e92046277170d3f03faf218373ffae1637f74816b682d09