skatteetateneu.wpenginepowered.com Open in urlscan Pro
141.193.213.11 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://skatteetateneu.wpenginepowered.com/nord/id/eng.html
Submission: On December 11 via manual (December 11th 2024, 2:34:51 pm UTC) from NO — Scanned from NO

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 12 HTTP transactions. The main IP is 141.193.213.11, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare London, LLC, US. The main domain is skatteetateneu.wpenginepowered.com.
TLS certificate: Issued by E6 on November 16th 2024. Valid for: 3 months.

This is the only time skatteetateneu.wpenginepowered.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BankID (Banking)

Domain & IP information

	IP Address	AS Autonomous System
10	141.193.213.11 141.193.213.11	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare London)
1	142.250.186.138 142.250.186.138	15169 (GOOGLE) (GOOGLE)
1	95.175.105.204 95.175.105.204	49282 (FICOLO Fi...) (FICOLO Ficolo Oy)
12	3

10 141.193.213.11 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US)

skatteetateneu.wpenginepowered.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.138 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f10.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 95.175.105.204 (Helsinki, Finland)

ASN49282 (FICOLO Ficolo Oy, FI)
PTR: kommunikasjon.ntb.no

kommunikasjon.ntb.no	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	wpenginepowered.com skatteetateneu.wpenginepowered.com	34 KB
1	ntb.no kommunikasjon.ntb.no	6 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 29	1 KB
12	3

	Domain	Requested by
10	skatteetateneu.wpenginepowered.com	skatteetateneu.wpenginepowered.com
1	kommunikasjon.ntb.no
1	fonts.googleapis.com	skatteetateneu.wpenginepowered.com
12	3

This site contains no links.

Subject Issuer	Validity	Valid
wpenginepowered.com E6	`2024-11-16` - `2025-02-14`	3 months	crt.sh
upload.video.google.com WR2	`2024-11-04` - `2025-01-27`	3 months	crt.sh
kommunikasjon.ntb.no R10	`2024-10-28` - `2025-01-26`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://skatteetateneu.wpenginepowered.com/nord/id/eng.html
Frame ID: A5D352AAD84AEF411753502AB58386F3
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

NORGE AS

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

41 kB
Transfer

231 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 Primary Request eng.html Show response
skatteetateneu.wpenginepowered.com/nord/id/ 3 KB
1 KB 1124ms
1009ms Document
text/html 141.193.213.11
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://skatteetateneu.wpenginepowered.com/nord/id/eng.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.11 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 45e9ddb7d0d4bbf42b7ce248033a6b0d886a35c9c01d3b9586112f59f783e57d

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: max-age=600, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 8f0632671edf9908-ARN
content-encoding: br
content-type: text/html
date: Wed, 11 Dec 2024 14:34:42 GMT
last-modified: Wed, 11 Dec 2024 09:15:51 GMT
priority: u=0,i
server: cloudflare
server-timing: cfExtPri
vary: Accept-Encoding Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
x-cache: HIT: 1
x-cache-group: iphone
x-cacheable: SHORT

GET
H3 200 bootstrap.css
skatteetateneu.wpenginepowered.com/nord/id/css/ 189 KB
26 KB 110ms
109ms Stylesheet
text/css 141.193.213.11
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://skatteetateneu.wpenginepowered.com/nord/id/css/bootstrap.css
Requested by: Host: skatteetateneu.wpenginepowered.com
URL: https://skatteetateneu.wpenginepowered.com/nord/id/eng.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.11 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 823d30ccfd5ba5d3e5c1efbd67b15390d49d8e0b4cfb36335057821778686917

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://skatteetateneu.wpenginepowered.com/nord/id/eng.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"67595847-2f22a"
age: 15045
cf-ray: 8f06326e4eca9908-ARN
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 11 Dec 2024 14:34:42 GMT
content-type: text/css
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare
last-modified: Wed, 11 Dec 2024 09:15:51 GMT
priority: u=0,i=?0

GET
H3 200 lary.css
skatteetateneu.wpenginepowered.com/nord/id/css/ 10 KB
2 KB 109ms
108ms Stylesheet
text/css 141.193.213.11
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://skatteetateneu.wpenginepowered.com/nord/id/css/lary.css
Requested by: Host: skatteetateneu.wpenginepowered.com
URL: https://skatteetateneu.wpenginepowered.com/nord/id/eng.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.11 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 26b09af686038eff10a161b0e3b88d0c311b829aee42126ca1d915a48018d8c6

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://skatteetateneu.wpenginepowered.com/nord/id/eng.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"67595847-279f"
age: 15045
cf-ray: 8f06326e4ece9908-ARN
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 11 Dec 2024 14:34:42 GMT
content-type: text/css
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare
last-modified: Wed, 11 Dec 2024 09:15:51 GMT
priority: u=0,i=?0

GET
H3 200 acc.svg
skatteetateneu.wpenginepowered.com/nord/id/image/ 2 KB
978 B 88ms
88ms Image
image/svg+xml 141.193.213.11
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://skatteetateneu.wpenginepowered.com/nord/id/image/acc.svg
Requested by: Host: skatteetateneu.wpenginepowered.com
URL: https://skatteetateneu.wpenginepowered.com/nord/id/eng.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.11 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2135db17253f889e03a392ec096f45b3a79cdb97b498841a698b2bf4a54e1bb4

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://skatteetateneu.wpenginepowered.com/nord/id/eng.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"67595847-824"
age: 15039
cf-ray: 8f06326e4ecf9908-ARN
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 11 Dec 2024 14:34:42 GMT
content-type: image/svg+xml
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare
last-modified: Wed, 11 Dec 2024 09:15:51 GMT
priority: u=2,i

GET
H3 200 bar_lg.png
skatteetateneu.wpenginepowered.com/nord/id/image/ 388 B
664 B 109ms
108ms Image
image/webp 141.193.213.11
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://skatteetateneu.wpenginepowered.com/nord/id/image/bar_lg.png
Requested by: Host: skatteetateneu.wpenginepowered.com
URL: https://skatteetateneu.wpenginepowered.com/nord/id/eng.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.11 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fd28b6a30856cd02cca7ef9c08733be740e18f4e4e75867267bf4e513e3f86f9

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://skatteetateneu.wpenginepowered.com/nord/id/eng.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cf-bgj: imgq:100,h2pri
etag: "67595847-374"
age: 15039
cf-cache-status: HIT
cf-polished: origFmt=png, origSize=884
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 11 Dec 2024 14:34:42 GMT
content-type: image/webp
content-disposition: inline; filename="bar_lg.webp"
vary: Accept
last-modified: Wed, 11 Dec 2024 09:15:51 GMT
priority: u=2,i
cache-control: public, max-age=31536000
cf-ray: 8f06326e4ed09908-ARN
accept-ranges: bytes
access-control-allow-origin: *
content-length: 388
server: cloudflare

GET
H3 200 sahm.svg
skatteetateneu.wpenginepowered.com/nord/id/image/ 172 B
366 B 102ms
102ms Image
image/svg+xml 141.193.213.11
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://skatteetateneu.wpenginepowered.com/nord/id/image/sahm.svg
Requested by: Host: skatteetateneu.wpenginepowered.com
URL: https://skatteetateneu.wpenginepowered.com/nord/id/eng.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.11 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4dca530d4682ddf6f4b9053173c007f95875c2634a6b61c9573d93fc21483766

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://skatteetateneu.wpenginepowered.com/nord/id/eng.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"67595844-ac"
age: 15039
cf-ray: 8f06327008de9908-ARN
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 11 Dec 2024 14:34:42 GMT
content-type: image/svg+xml
vary: Accept-Encoding, Accept-Encoding
server: cloudflare
last-modified: Wed, 11 Dec 2024 09:15:48 GMT
priority: u=2,i

GET
H3 200 protege.png
skatteetateneu.wpenginepowered.com/nord/id/image/ 2 KB
3 KB 89ms
79ms Image
image/png 141.193.213.11
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://skatteetateneu.wpenginepowered.com/nord/id/image/protege.png
Requested by: Host: skatteetateneu.wpenginepowered.com
URL: https://skatteetateneu.wpenginepowered.com/nord/id/eng.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.11 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 375aa9cbfaf03a02679363d4967f662930ea9eb9bc7e75e1ae50e5bd105844fc

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://skatteetateneu.wpenginepowered.com/nord/id/eng.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cf-bgj: imgq:100,h2pri
etag: "67595844-12f5"
age: 15039
cf-cache-status: HIT
cf-polished: origSize=4853, status=webp_bigger
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 11 Dec 2024 14:34:42 GMT
content-type: image/png
last-modified: Wed, 11 Dec 2024 09:15:48 GMT
vary: Accept-Encoding
priority: u=2,i
cache-control: public, max-age=31536000
cf-ray: 8f06327039139908-ARN
accept-ranges: bytes
access-control-allow-origin: *
content-length: 2381
server: cloudflare

GET
H3 404 jquery-3.5.1.min.js
skatteetateneu.wpenginepowered.com/nord/id/js/ 0
0 871ms
867ms Script
text/html 141.193.213.11
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://skatteetateneu.wpenginepowered.com/nord/id/js/jquery-3.5.1.min.js
Requested by: Host: skatteetateneu.wpenginepowered.com
URL: https://skatteetateneu.wpenginepowered.com/nord/id/eng.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.11 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://skatteetateneu.wpenginepowered.com/nord/id/eng.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
cf-cache-status: EXPIRED
cf-ray: 8f063270e9de9908-ARN
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 11 Dec 2024 14:34:43 GMT
content-type: text/html
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare
priority: u=2,i=?0

GET
H3 404 jquery.mask.js
skatteetateneu.wpenginepowered.com/nord/id/js/ 0
0 1057ms
1057ms Script
text/html 141.193.213.11
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://skatteetateneu.wpenginepowered.com/nord/id/js/jquery.mask.js
Requested by: Host: skatteetateneu.wpenginepowered.com
URL: https://skatteetateneu.wpenginepowered.com/nord/id/eng.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.11 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://skatteetateneu.wpenginepowered.com/nord/id/eng.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
cf-cache-status: EXPIRED
cf-ray: 8f063270e9e09908-ARN
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 11 Dec 2024 14:34:43 GMT
content-type: text/html
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare
priority: u=2,i=?0

GET
H2 200 css2
fonts.googleapis.com/ 19 KB
1 KB 797ms
75ms Stylesheet
text/css 142.250.186.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Wix+Madefor+Text:ital,wght@0,400;0,500;0,600;0,700;0,800;1,400;1,500;1,600;1,700;1,800&display=swap

Requested by

Host: skatteetateneu.wpenginepowered.com
URL: https://skatteetateneu.wpenginepowered.com/nord/id/css/lary.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f10.1e100.net

Software

ESF /

Resource Hash

af149a3bd3453977e6a908a2375f1c012bb8cff3de05709af5b0bb1a5c9e7506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://skatteetateneu.wpenginepowered.com/
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Wed, 11 Dec 2024 14:34:43 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 11 Dec 2024 14:34:43 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Wed, 11 Dec 2024 14:34:43 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H3 404 favicon.20f0cd89.ico
skatteetateneu.wpenginepowered.com/nord/source/ 548 B
329 B 850ms
849ms Other
text/html 141.193.213.11
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://skatteetateneu.wpenginepowered.com/nord/source/favicon.20f0cd89.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.11 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://skatteetateneu.wpenginepowered.com/nord/id/eng.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
cf-cache-status: EXPIRED
cf-ray: 8f0632799c169908-ARN
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 11 Dec 2024 14:34:44 GMT
content-type: text/html
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare
priority: u=1,i

GET
H2 200 95f3a80b-ceb5-4afb-9e0a-d1611744ba4d-w_300_h_250.jpg
kommunikasjon.ntb.no/data/images/00306/ 6 KB
6 KB 565ms
71ms Other
image/jpeg 95.175.105.204
FICOLO Ficolo Oy

General

Check archive.org

Show headers Download Go to

Full URL

https://kommunikasjon.ntb.no/data/images/00306/95f3a80b-ceb5-4afb-9e0a-d1611744ba4d-w_300_h_250.jpg

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.175.105.204 Helsinki, Finland, ASN49282 (FICOLO Ficolo Oy, FI),

Reverse DNS

kommunikasjon.ntb.no

Software

nginx /

Resource Hash

425b9ac25db41d127ce9ec8871f06cfbfdefbca4e9c91f1dc401e9ec3cebdddd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://skatteetateneu.wpenginepowered.com/
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
referrer-policy: strict-origin-when-cross-origin
cache-control: max-age=2592000
etag: W/"12533788021"
access-control-allow-methods: POST, PUT, GET, DELETE, OPTIONS
x-prs-image-width: 208
expires: Fri, 10 Jan 2025 14:34:45 GMT
access-control-allow-origin: https://kommunikasjon.ntb.no
content-length: 5707
date: Wed, 11 Dec 2024 14:34:45 GMT
content-type: image/jpeg
server: nginx
x-prs-image-height: 250
access-control-allow-headers: Accept, Accept-Language, Content-Language, Content-Type, Origin

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BankID (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://skatteetateneu.wpenginepowered.com/nord/id/js/jquery-3.5.1.min.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://skatteetateneu.wpenginepowered.com/nord/id/js/jquery.mask.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://skatteetateneu.wpenginepowered.com/nord/source/favicon.20f0cd89.ico Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
kommunikasjon.ntb.no
skatteetateneu.wpenginepowered.com
141.193.213.11
142.250.186.138
95.175.105.204
2135db17253f889e03a392ec096f45b3a79cdb97b498841a698b2bf4a54e1bb4
26b09af686038eff10a161b0e3b88d0c311b829aee42126ca1d915a48018d8c6
375aa9cbfaf03a02679363d4967f662930ea9eb9bc7e75e1ae50e5bd105844fc
425b9ac25db41d127ce9ec8871f06cfbfdefbca4e9c91f1dc401e9ec3cebdddd
45e9ddb7d0d4bbf42b7ce248033a6b0d886a35c9c01d3b9586112f59f783e57d
4dca530d4682ddf6f4b9053173c007f95875c2634a6b61c9573d93fc21483766
823d30ccfd5ba5d3e5c1efbd67b15390d49d8e0b4cfb36335057821778686917
af149a3bd3453977e6a908a2375f1c012bb8cff3de05709af5b0bb1a5c9e7506
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090
fd28b6a30856cd02cca7ef9c08733be740e18f4e4e75867267bf4e513e3f86f9

skatteetateneu.wpenginepowered.com Open in urlscan Pro 141.193.213.11 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

12 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

41 kBTransfer

231 kBSize

0 Cookies

0 Outgoing links

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

3 Console Messages

Indicators

skatteetateneu.wpenginepowered.com Open in urlscan Pro
141.193.213.11 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

41 kB
Transfer

231 kB
Size

0
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!