tunnistautuminen-suomi.eu

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 1 HTTP transactions. The main IP is 192.185.48.230, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is tunnistautuminen-suomi.eu.

This is the only time tunnistautuminen-suomi.eu was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Nordea (Banking)

Domain & IP information

	IP Address		AS Autonomous System
1 2	192.185.48.230 192.185.48.230		46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
1	2

2 192.185.48.230 (United States) 1 redirects

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 192-185-48-230.unifiedlayer.com

tunnistautuminen-suomi.eu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	tunnistautuminen-suomi.eu 1 redirects tunnistautuminen-suomi.eu	321 KB
1	1

	Domain	Requested by
2	tunnistautuminen-suomi.eu	1 redirects
1	1

This site contains links to these domains. Also see Links.

Domain
www.nordea.fi

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://tunnistautuminen-suomi.eu/FI/sivut/identify.nordea.com/
Frame ID: FBA7C41EB18B8DBFC70AD8E8C4115C05
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Nordea - Tunnistautuminen

Page URL History Show full URLs

http://tunnistautuminen-suomi.eu/FI/sivut/identify.nordea.com HTTP 301
http://tunnistautuminen-suomi.eu/FI/sivut/identify.nordea.com/ Page URL

Page Statistics

1
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

373 kB
Transfer

567 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.nordea.fi/henkiloasiakkaat/palvelumme/verkko-mobiilipalvelut/tunnuslukulaite.html
Title: www.nordea.fi

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://tunnistautuminen-suomi.eu/FI/sivut/identify.nordea.com HTTP 301
http://tunnistautuminen-suomi.eu/FI/sivut/identify.nordea.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

1 HTTP transactions
6 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response tunnistautuminen-suomi.eu/FI/sivut/identify.nordea.com/ Redirect Chain http://tunnistautuminen-suomi.eu/FI/sivut/identify.nordea.com http://tunnistautuminen-suomi.eu/FI/sivut/identify.nordea.com/	444 KB 321 KB	163ms 155ms	Document text/html	192.185.48.230 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL http://tunnistautuminen-suomi.eu/FI/sivut/identify.nordea.com/ Protocol HTTP/1.1 Server 192.185.48.230 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 192-185-48-230.unifiedlayer.com Software Apache / Resource Hash `e226976d45f8a40e108786570cbb73758f8acf9fe45b9684f347676d74c90d49` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Date Mon, 14 Feb 2022 10:05:56 GMT Server Apache Last-Modified Mon, 10 Jan 2022 15:02:00 GMT Accept-Ranges bytes Vary Accept-Encoding Content-Encoding gzip Keep-Alive timeout=5, max=74 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html Redirect headers Date Mon, 14 Feb 2022 10:05:56 GMT Server Apache Location http://tunnistautuminen-suomi.eu/FI/sivut/identify.nordea.com/ Content-Length 270 Keep-Alive timeout=5, max=75 Connection Keep-Alive Content-Type text/html; charset=iso-8859-1
GET DATA	200 OK	truncated /	1 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `b88b6130e6d786e3793f9811c6ad215e23237c3875b1bd85330505dc8ff350f9` Request headers Accept-Language de-DE,de;q=0.9 Referer http://tunnistautuminen-suomi.eu/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	2 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `4bb0667918cd4d97513a0d51d50ed3f3cf4d61ddb35f6319cde294149ebb79ae` Request headers Accept-Language de-DE,de;q=0.9 Referer http://tunnistautuminen-suomi.eu/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	671 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `23c76e6a9df05e6f95e1384fbf5566300447cf8a2e658af4de19bb52c14eeadf` Request headers Accept-Language de-DE,de;q=0.9 Referer http://tunnistautuminen-suomi.eu/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	67 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `836393ac52708bd75b2e1c88defb51faa58f0fdfa374d57d2529e0a6554882ff` Request headers Accept-Language de-DE,de;q=0.9 Referer http://tunnistautuminen-suomi.eu/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	26 KB 26 KB		Font application/font-woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `443bd1fde75a477eaae12ba7828c6cb67608e14bbda783027fca2540c3bb0b03` Request headers Referer http://tunnistautuminen-suomi.eu/ Origin http://tunnistautuminen-suomi.eu Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers Content-Type application/font-woff2
GET DATA	200 OK	truncated /	26 KB 26 KB		Font application/font-woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a93f6086756b2a2e94db8aaf795faab950a315cd9a8e32c5b0df707636dedfff` Request headers Referer http://tunnistautuminen-suomi.eu/ Origin http://tunnistautuminen-suomi.eu Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers Content-Type application/font-woff2

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Nordea (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

tunnistautuminen-suomi.eu
192.185.48.230
23c76e6a9df05e6f95e1384fbf5566300447cf8a2e658af4de19bb52c14eeadf
443bd1fde75a477eaae12ba7828c6cb67608e14bbda783027fca2540c3bb0b03
4bb0667918cd4d97513a0d51d50ed3f3cf4d61ddb35f6319cde294149ebb79ae
836393ac52708bd75b2e1c88defb51faa58f0fdfa374d57d2529e0a6554882ff
a93f6086756b2a2e94db8aaf795faab950a315cd9a8e32c5b0df707636dedfff
b88b6130e6d786e3793f9811c6ad215e23237c3875b1bd85330505dc8ff350f9
e226976d45f8a40e108786570cbb73758f8acf9fe45b9684f347676d74c90d49

tunnistautuminen-suomi.eu Open in urlscan Pro 192.185.48.230 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

1 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

373 kBTransfer

567 kBSize

0 Cookies

1 Outgoing links

Page URL History

Redirected requests

1 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

Indicators

tunnistautuminen-suomi.eu Open in urlscan Pro
192.185.48.230 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

1
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

373 kB
Transfer

567 kB
Size

0
Cookies

1 HTTP transactions
6 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!