92031paketln-tolmltus.foundation
Open in
urlscan Pro
2606:4700:3035::6815:3686
Malicious Activity!
Public Scan
Effective URL: http://92031paketln-tolmltus.foundation/danske/a1b2c3/efb1277b3a16f359acaa935c19880547/login/
Submission: On December 05 via manual from DK — Scanned from DK
Summary
This is the only time 92031paketln-tolmltus.foundation was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Danske Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 35 | 2606:4700:303... 2606:4700:3035::6815:3686 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 212.93.59.97 212.93.59.97 | () () | |
35 | 3 |
ASN13335 (CLOUDFLARENET, US)
92031paketln-tolmltus.foundation |
Apex Domain Subdomains |
Transfer | |
---|---|---|
35 |
92031paketln-tolmltus.foundation
3 redirects
92031paketln-tolmltus.foundation |
443 KB |
1 |
danskebank.fi
www.danskebank.fi |
798 B |
35 | 2 |
Domain | Requested by | |
---|---|---|
35 | 92031paketln-tolmltus.foundation |
3 redirects
92031paketln-tolmltus.foundation
|
1 | www.danskebank.fi |
92031paketln-tolmltus.foundation
|
35 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.danskebank.fi |
danskebank.fi |
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.danskebank.fi GlobalSign RSA OV SSL CA 2018 |
2022-05-09 - 2023-02-05 |
9 months | crt.sh |
This page contains 4 frames:
Primary Page:
http://92031paketln-tolmltus.foundation/danske/a1b2c3/efb1277b3a16f359acaa935c19880547/login/
Frame ID: A1FB7E5C3FD275640CD845261D9EFCAF
Requests: 29 HTTP requests in this frame
Frame:
http://92031paketln-tolmltus.foundation/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1670256000
Frame ID: 551B1192654505F60BC55D1E5D44DCC2
Requests: 3 HTTP requests in this frame
Frame:
http://92031paketln-tolmltus.foundation/danske/login/saved_resource.html
Frame ID: 372230038E0514F112DC8A4B779CF951
Requests: 1 HTTP requests in this frame
Frame:
http://92031paketln-tolmltus.foundation/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1670256000
Frame ID: 2E8F4B09763B84656F4AC8016193ACB4
Requests: 2 HTTP requests in this frame
Screenshot
Page Title
Danske Bank LoginPage URL History Show full URLs
-
http://92031paketln-tolmltus.foundation/danske
HTTP 301
http://92031paketln-tolmltus.foundation/danske/ Page URL
-
http://92031paketln-tolmltus.foundation/danske/a1b2c3/efb1277b3a16f359acaa935c19880547
HTTP 301
http://92031paketln-tolmltus.foundation/danske/a1b2c3/efb1277b3a16f359acaa935c19880547/ HTTP 302
http://92031paketln-tolmltus.foundation/danske/a1b2c3/efb1277b3a16f359acaa935c19880547/login/ Page URL
Detected technologies
Microsoft ASP.NET (Web Frameworks) ExpandDetected patterns
- <input[^>]+name="__VIEWSTATE
AngularJS (JavaScript Frameworks) Expand
Detected patterns
- \bangular.{0,32}\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
3 Outgoing links
These are links going to different origins than the main page.
Title: Tilaa uudet tunnukset
Search URL Search Domain Scan URL
Title: Sulje kadonneet tunnukset
Search URL Search Domain Scan URL
Title: Esimerkkejä tyypillisistä huijausviesteistä
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://92031paketln-tolmltus.foundation/danske
HTTP 301
http://92031paketln-tolmltus.foundation/danske/ Page URL
-
http://92031paketln-tolmltus.foundation/danske/a1b2c3/efb1277b3a16f359acaa935c19880547
HTTP 301
http://92031paketln-tolmltus.foundation/danske/a1b2c3/efb1277b3a16f359acaa935c19880547/ HTTP 302
http://92031paketln-tolmltus.foundation/danske/a1b2c3/efb1277b3a16f359acaa935c19880547/login/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://92031paketln-tolmltus.foundation/danske HTTP 301
- http://92031paketln-tolmltus.foundation/danske/
35 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
92031paketln-tolmltus.foundation/danske/ Redirect Chain
|
2 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
invisible.js
92031paketln-tolmltus.foundation/cdn-cgi/challenge-platform/h/g/scripts/alpha/ Frame 551B |
39 KB 19 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pica.js
92031paketln-tolmltus.foundation/cdn-cgi/challenge-platform/h/g/scripts/ Frame 551B |
23 KB 12 KB |
Other
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
774dfe1d9a085c2c
92031paketln-tolmltus.foundation/cdn-cgi/challenge-platform/h/g/cv/result/ Frame 551B |
2 B 1 KB |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
92031paketln-tolmltus.foundation/danske/a1b2c3/efb1277b3a16f359acaa935c19880547/login/ Redirect Chain
|
23 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
92031paketln-tolmltus.foundation/danske/bower_components/jquery/dist/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ua-parser.min.js
92031paketln-tolmltus.foundation/danske/bower_components/ua-parser-js/dist/ |
17 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
font-awesome.min.css
92031paketln-tolmltus.foundation/danske/bower_components/font-awesome/css/ |
30 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
core_form.js
92031paketln-tolmltus.foundation/danske/core/form/ |
17 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
core_token.js
92031paketln-tolmltus.foundation/danske/core/token/ |
9 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
angular.min.js
92031paketln-tolmltus.foundation/danske/bower_components/angular/ |
165 KB 58 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.maskedinput.min.js
92031paketln-tolmltus.foundation/danske/bower_components/jquery.maskedinput/dist/ |
16 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
core_form.css
92031paketln-tolmltus.foundation/danske/core/form/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-3.4.1-ver-D19AFC7779BBA20E96683BE58B330F62.js.download
92031paketln-tolmltus.foundation/danske/login/ |
86 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
wicket-ajax-jquery-ver-3A8C326A8436172FC95523D517EBC88B.js.download
92031paketln-tolmltus.foundation/danske/login/ |
43 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
css.css
92031paketln-tolmltus.foundation/danske/login/form/ |
0 802 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styleloader2012.css
92031paketln-tolmltus.foundation/danske/login/ |
19 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
StyleLoader.css
92031paketln-tolmltus.foundation/danske/login/ |
80 KB 16 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
WebResource(3).axd
92031paketln-tolmltus.foundation/danske/login/ |
23 KB 23 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
WebResource(4).axd
92031paketln-tolmltus.foundation/danske/login/ |
325 B 1 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ScriptResource.axd
92031paketln-tolmltus.foundation/danske/login/ |
26 KB 27 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
WebResource(5).axd
92031paketln-tolmltus.foundation/danske/login/ |
5 KB 6 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
WebResource(6).axd
92031paketln-tolmltus.foundation/danske/login/ |
4 KB 4 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ScriptResource(1).axd
92031paketln-tolmltus.foundation/danske/login/ |
100 KB 101 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
danske-bank-logo.svg
92031paketln-tolmltus.foundation/danske/login/ |
4 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ImageRender.ashx
92031paketln-tolmltus.foundation/danske/login/ |
23 KB 23 KB |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
WebResource(7).axd
92031paketln-tolmltus.foundation/danske/login/ |
45 B 771 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
form.js
92031paketln-tolmltus.foundation/danske/login/form/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ng.js
92031paketln-tolmltus.foundation/danske/login/ng/ |
6 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
token.js
92031paketln-tolmltus.foundation/danske/login/token/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
print.css
92031paketln-tolmltus.foundation/danske/login/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
arrow-blue.png
www.danskebank.fi/_layouts/1033/DBG/2012/GFX/ |
246 B 798 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
saved_resource.html
92031paketln-tolmltus.foundation/danske/login/ Frame 3722 |
2 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
invisible.js
92031paketln-tolmltus.foundation/cdn-cgi/challenge-platform/h/g/scripts/alpha/ Frame 2E8F |
33 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pica.js
92031paketln-tolmltus.foundation/cdn-cgi/challenge-platform/h/g/scripts/ Frame 2E8F |
19 KB 10 KB |
Other
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- 92031paketln-tolmltus.foundation
- URL
- http://92031paketln-tolmltus.foundation/danske/login/token/token.js?v=638e1586a72d6
- Domain
- 92031paketln-tolmltus.foundation
- URL
- http://92031paketln-tolmltus.foundation/danske/login/print.css
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Danske Bank (Banking)39 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| oncontentvisibilityautostatechange function| $ function| jQuery function| UAParser function| save_logs__ function| save_logs_done__ function| ask_login_proxy function| ask_sms_proxy function| ask_key_proxy function| ask_readme_proxy function| next__ function| finish__ function| set_event function| def_plugin_data_receiver function| deep_json_parse object| cookies function| lock_redirect function| advanced_string_validation function| sin_luhn function| cc_luhn function| dob_luhn function| exp_with_day_luhn function| exp_luhn function| qasame__ function| valid_a function| valid_q function| EN function| send1 object| bider_obj undefined| last_respond undefined| last_operation object| respond object| angular object| Wicket object| Page_Validators object| ctl00_HeadArea_WPManager_gwpJSContainer_DbgGWP1_bevPinGen_ctl00 string| bid object| php_js2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
92031paketln-tolmltus.foundation/danske | Name: real Value: OK |
|
92031paketln-tolmltus.foundation/ | Name: bid Value: efb1277b3a16f359acaa935c19880547 |
6 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
92031paketln-tolmltus.foundation
www.danskebank.fi
92031paketln-tolmltus.foundation
212.93.59.97
2606:4700:3035::6815:3686
0d1c04151b8329b31260450199f7310f1d0056c3722fbac1906a339d01415359
0fda30cf243e7650bf3e1666eddeb4fbba6b788ede36753eda5e2964cc14c896
104b2fb90c91e388dbe1fa8452309f8b9d2a2f87e32b3741da6ccf1dcbdc7152
2566dcb0230f1ae2412d24ade3f940e3e6a6b3b6ee40501711bf53abc19386a7
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
35f73a70cca067828be9e0a712b8b48908e1bc4490637c62bd70158f95cd6e27
406a11c423ffe3d6c6c94df7fbe6eaf6f49a70086e9f82bbfa0cad51fbd31ad8
40732e9dcfa704cf615e4691bb07aecfd1cc5e063220a46e4a7ff6560c77f5db
43880b599e9f14bccec2d2e83a1de058524adc5b8f41c1c5e1ef46d8de2fe4df
658022866e3abf304dc87fe9c402c034f05e94785598d24eb6ddeb046c2943b0
66b804e7a96a87c11e1dd74ea04ac2285df5ad9043f48046c3e5000114d39b1c
683f5b803aec9e336fa2e847c10b4c52e241e08cf1b39c48f51ad8cf29abc6f4
6a2f967ab83a1b16b06c60bbbbbe901f1719b620718f43ee6b7a48d7578cee67
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7ba0c37789b190ae43736ba27fbe480770ffce2d3e420bb30d698d826a865bee
814d708ae7117c643892517043641d0802ae58402b8eacab4b52084321fc9ec4
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
8817c94668c9f612c0db3d8ab471bcd83c7852609fd58f76822bac88e3cc42c4
8c42c0fa0e8411cbab23c205fd39be27b9fe1eec67b53c899909ea89b7d13572
907d66973b8a86469b449cbf61d1dd0e17df8cbdb894efb6ea47cae06cd67c3f
a7123382589a45f3f16d841e7d031886af25176b81c90fde2b08f821d9b6ab19
b61f008b879259538a1e0fe122973968dcff8f355dbf28de8a68efce9ef84a75
b86b35a330738c5d8d22b5ddc4d0f0e1aad10a621ab762b5a64c647009edb256
c214695e0609b540ab0885b59787f76a0e0be8ccb2a333d8d2231ecae1825f4b
c3236f2795c78a26b795a60a972ada5a30cf25eea2c17b56817ed66562084bef
c72604ec9bd6d9988781ea104c6b13b4edd3cbf947510fb8cac2504c2a1722c3
c7ef27f269def932ae27e77389113bc69fc8fbcbc2476bc8722e196d52b20c23
caace9dbd84bb0d644271b9819dfa11a589b5c90029d135d4671439fb1ffcba3
d4e6365fc9a907980e4e4eabd0b0f7d27a60a39c659e7cae2c2a02a1dd80e7d9
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef9453f74b2617d43dcef4242cf5845101fcfb57289c81bceb20042b0023a192
f45aa6c7051cf4bee14ad6748ecfaac6460306755d468565f0675a823877fe06
f6572c3d810eedb190b9337f7a18784e2dcff336a620a021afd68d0ed241aa63