account.easyassurance.com.np
Open in
urlscan Pro
69.57.172.27
Malicious Activity!
Public Scan
Submitted URL: http://url6427.mail.promomailapp.com/ls/click?upn=u001.sDWjSI9Sh0V45xCCmrLnzs49Pdx2as9KJfSCVGaCy3LG1-2BS92G8plGRt3dXNNcEs9zPE-2BCuqiZ...
Effective URL: https://account.easyassurance.com.np/no/pre-auth/def/auth?country=NO&lang=no
Submission: On March 03 via automatic, source phishtank — Scanned from DE
Effective URL: https://account.easyassurance.com.np/no/pre-auth/def/auth?country=NO&lang=no
Submission: On March 03 via automatic, source phishtank — Scanned from DE
Summary
This website contacted 4 IPs
in 3 countries
across 5 domains to perform 11 HTTP transactions.
The main IP is 69.57.172.27, located in
Navi Mumbai, India and
belongs to FORTRESSITX, US.
The main domain is account.easyassurance.com.np.
TLS certificate: Issued by R3 on January 7th 2024. Valid for: 3 months.
This is the only time account.easyassurance.com.np was scanned on urlscan.io!
TLS certificate: Issued by R3 on January 7th 2024. Valid for: 3 months.
This is the only time account.easyassurance.com.np was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: EasyPark (Transportation)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 1 | 167.89.123.204 167.89.123.204 | 11377 (SENDGRID) (SENDGRID) | |
| 1 1 | 18.239.50.65 18.239.50.65 | 16509 (AMAZON-02) (AMAZON-02) | |
| 2 9 | 69.57.172.27 69.57.172.27 | 25653 (FORTRESSITX) (FORTRESSITX) | |
| 2 | 2a02:26f0:350... 2a02:26f0:3500:16::215:148f | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
| 4 5 | 2620:1ec:21::14 2620:1ec:21::14 | 8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
| 1 | 13.107.42.14 13.107.42.14 | 8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
| 11 | 4 |
1
167.89.123.204
(Chicago, United States)
ASN11377 (SENDGRID, US)
PTR: o16789123x204.outbound-mail.sendgrid.net
ASN11377 (SENDGRID, US)
PTR: o16789123x204.outbound-mail.sendgrid.net
| url6427.mail.promomailapp.com |
1
18.239.50.65
(United States)
ASN16509 (AMAZON-02, US)
PTR: server-18-239-50-65.ams58.r.cloudfront.net
ASN16509 (AMAZON-02, US)
PTR: server-18-239-50-65.ams58.r.cloudfront.net
| services.promo.ai |
9
69.57.172.27
(Navi Mumbai, India)
ASN25653 (FORTRESSITX, US)
PTR: s787.bom1.mysecurecloudhost.com
ASN25653 (FORTRESSITX, US)
PTR: s787.bom1.mysecurecloudhost.com
| account.easyassurance.com.np |
2
2a02:26f0:3500:16::215:148f
(Frankfurt am Main, Germany)
ASN20940 (AKAMAI-ASN1, NL)
ASN20940 (AKAMAI-ASN1, NL)
| snap.licdn.com |
5
2620:1ec:21::14
(United States)
ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
| px.ads.linkedin.com | |
| www.linkedin.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 9 |
easyassurance.com.np
2 redirects
account.easyassurance.com.np |
84 KB |
| 6 |
linkedin.com
4 redirects
px.ads.linkedin.com — Cisco Umbrella Rank: 353 www.linkedin.com — Cisco Umbrella Rank: 629 px4.ads.linkedin.com — Cisco Umbrella Rank: 6596 |
3 KB |
| 2 |
licdn.com
snap.licdn.com — Cisco Umbrella Rank: 781 |
18 KB |
| 1 |
promo.ai
1 redirects
services.promo.ai |
362 B |
| 1 |
promomailapp.com
1 redirects
url6427.mail.promomailapp.com |
344 B |
| 11 | 5 |
| Domain | Requested by | |
|---|---|---|
| 9 | account.easyassurance.com.np |
2 redirects
account.easyassurance.com.np
|
| 4 | px.ads.linkedin.com |
3 redirects
snap.licdn.com
|
| 2 | snap.licdn.com |
account.easyassurance.com.np
snap.licdn.com |
| 1 | px4.ads.linkedin.com |
account.easyassurance.com.np
|
| 1 | www.linkedin.com | 1 redirects |
| 1 | services.promo.ai | 1 redirects |
| 1 | url6427.mail.promomailapp.com | 1 redirects |
| 11 | 7 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| dashboard.easypark.net |
| legals.easyparksystem.net |
| customer.easypark.net |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| www.account.easyassurance.com.np R3 |
2024-01-07 - 2024-04-06 |
3 months | crt.sh |
| snap.licdn.com DigiCert SHA2 Secure Server CA |
2023-12-13 - 2024-12-12 |
a year | crt.sh |
| www.linkedin.com DigiCert SHA2 Secure Server CA |
2024-01-30 - 2024-07-30 |
6 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://account.easyassurance.com.np/no/pre-auth/def/auth?country=NO&lang=no
Frame ID: 1F625787660E56B36F942E5DA50D16B7
Requests: 11 HTTP requests in this frame
Screenshot
Page Title
Logg inn på kontoen for å se dine elektroniske kvitteringerPage URL History Show full URLs
-
http://url6427.mail.promomailapp.com/ls/click?upn=u001.sDWjSI9Sh0V45xCCmrLnzs49Pdx2as9KJfSCVGaCy3LG1-2BS92G8plGRt...
HTTP 302
https://services.promo.ai/mail/click/s48e9d33ed25d40a3a79d68ee78efcbc6/sub925f7d19213b44a1aa7b5206dd86... HTTP 302
https://account.easyassurance.com.np/no/pre-auth/def HTTP 301
https://account.easyassurance.com.np/no/pre-auth/def/ HTTP 302
https://account.easyassurance.com.np/no/pre-auth/def/auth?country=NO&lang=no Page URL
Detected technologies
Linkedin Insight Tag
(Analytics)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- snap\.licdn\.com/li\.lms-analytics/insight\.min\.js
Page Statistics
5 Outgoing links
These are links going to different origins than the main page.
URL: https://dashboard.easypark.net/
Title: Logg inn som parkeringsoperatør
Title: Logg inn som parkeringsoperatør
Search URL Search Domain Scan URL
URL: https://legals.easyparksystem.net/NO/tc/no/terms_no_no.pdf
Title: Vilkår og betingelser
Title: Vilkår og betingelser
Search URL Search Domain Scan URL
URL: https://legals.easyparksystem.net/B2B/terms_b2b_v1_0_no.pdf
Title: Vilkår og betingelser
Title: Vilkår og betingelser
Search URL Search Domain Scan URL
URL: https://legals.easyparksystem.net/NO/privacy/no/privacy_no_no.pdf
Title: Personvernerklæring
Title: Personvernerklæring
Search URL Search Domain Scan URL
URL: https://customer.easypark.net/help/en/4067
Title: Kontakt oss
Title: Kontakt oss
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://url6427.mail.promomailapp.com/ls/click?upn=u001.sDWjSI9Sh0V45xCCmrLnzs49Pdx2as9KJfSCVGaCy3LG1-2BS92G8plGRt3dXNNcEs9zPE-2BCuqiZyUD-2F5OmKy1I6g-2FiJNxp8WjJb2zW4z6kBq12rWBL5EJk-2BZ0lz6FFq8KKKdabbSYM-2BXqNioNtBEs7QTONaQSwDTf7A3rK7xldTlK1qtMGZTHa6s65Dd2bx34miR7WC8MrzAg31hFh-2BnHGg-3D-3DjPQt_IBti77zVz78BB1wKxZpbwY2sH7Qap7x9GY-2B2yZh-2Fv45q6KtSSbiGbqUpy2IujVsTEbMCfZATpbeFiZbppr2m9O3WXQ2UeiljH8sW-2F5leY24w81y2fTG-2FzEASKUip-2ByuDkiNk2HfERu3Z-2FwfPvEvgRASFGawtz9Ysv6eldofNdIHWNdGtPnAThqiIMYqEoyyatC53kWqB-2BuypxeT-2FffmYI0s1G5Yax8ic-2F8wwHv7pt9250hgKaekQeYGTiNrn4YM2Y9leJW2e0qxVVn-2FOFEvuNnmKwc7pUACEGpy4swqfx0p7NZMp81ECA3WltJm2jli7uuhMRRKiPVYP4TSorqSk6gXu2Kbgjd8tv9IJLpvNQuOKzEuBEFEWjTDy7XtR4Tdy
HTTP 302
https://services.promo.ai/mail/click/s48e9d33ed25d40a3a79d68ee78efcbc6/sub925f7d19213b44a1aa7b5206dd8659ce/l8529b9590e144ed7bf6527ebcf03df44 HTTP 302
https://account.easyassurance.com.np/no/pre-auth/def HTTP 301
https://account.easyassurance.com.np/no/pre-auth/def/ HTTP 302
https://account.easyassurance.com.np/no/pre-auth/def/auth?country=NO&lang=no Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 8- https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1237801&time=1709486632284&li_adsId=af3af109-9b66-492b-ba54-0594fed175b4&url=https%3A%2F%2Faccount.easyassurance.com.np%2Fno%2Fpre-auth%2Fdef%2Fauth%3Fcountry%3DNO%26lang%3Dno HTTP 302
- https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1237801&time=1709486632284&li_adsId=af3af109-9b66-492b-ba54-0594fed175b4&url=https%3A%2F%2Faccount.easyassurance.com.np%2Fno%2Fpre-auth%2Fdef%2Fauth%3Fcountry%3DNO%26lang%3Dno&cookiesTest=true HTTP 302
- https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1237801%26time%3D1709486632284%26li_adsId%3Daf3af109-9b66-492b-ba54-0594fed175b4%26url%3Dhttps%253A%252F%252Faccount.easyassurance.com.np%252Fno%252Fpre-auth%252Fdef%252Fauth%253Fcountry%253DNO%2526lang%253Dno%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
- https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1237801&time=1709486632284&li_adsId=af3af109-9b66-492b-ba54-0594fed175b4&url=https%3A%2F%2Faccount.easyassurance.com.np%2Fno%2Fpre-auth%2Fdef%2Fauth%3Fcountry%3DNO%26lang%3Dno&cookiesTest=true&liSync=true HTTP 302
- https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1237801&time=1709486632284&li_adsId=af3af109-9b66-492b-ba54-0594fed175b4&url=https%3A%2F%2Faccount.easyassurance.com.np%2Fno%2Fpre-auth%2Fdef%2Fauth%3Fcountry%3DNO%26lang%3Dno&cookiesTest=true&liSync=true&e_ipv6=AQItCKMYwbTGQAAAAY4FV-_mRGKogFea4ff8C-SOHGIokgTZpY_TYNCMVnskznAF
11 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
auth
account.easyassurance.com.np/no/pre-auth/def/ Redirect Chain
|
94 KB 17 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
main.0f5210b5.css
account.easyassurance.com.np/no/pre-auth/def/static/css/ |
162 B 430 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
logo-color-216x31.b60799681750b2a47287.png
account.easyassurance.com.np/no/pre-auth/def/static/media/ |
13 KB 13 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
no.6df96bb22557028a5f77.svg
account.easyassurance.com.np/no/pre-auth/def/static/media/ |
321 B 220 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
log0-34syp4ck.png
account.easyassurance.com.np/no/pre-auth/def/assets/images/ |
20 KB 21 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
poppins-regular-webfont.ad4ead5a378cd8743b7d.woff2
account.easyassurance.com.np/no/pre-auth/def/static/media/ |
16 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
poppins-bold-webfont.60f06b3aefdc411f2506.woff2
account.easyassurance.com.np/no/pre-auth/def/static/media/ |
16 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
insight.min.js
snap.licdn.com/li.lms-analytics/ |
1 KB 857 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
insight.beta.min.js
snap.licdn.com/li.lms-analytics/ |
48 KB 17 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
collect
px4.ads.linkedin.com/ Redirect Chain
|
0 265 B |
Image
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H2 |
/
px.ads.linkedin.com/wa/ |
0 202 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: EasyPark (Transportation)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
string| _linkedin_partner_id object| _linkedin_data_partner_ids function| lintrk boolean| _already_called_lintrk object| ORIBILI7 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| .linkedin.com/ | Name: li_sugr Value: f5661367-f3f9-49a7-9964-d5f989df0a08 |
|
| .linkedin.com/ | Name: bcookie Value: "v=2&8f431294-2f8a-4c07-8713-91c3a3bbeafd" |
|
| .linkedin.com/ | Name: lidc Value: "b=TGST09:s=T:r=T:a=T:p=T:g=2707:u=1:x=1:i=1709486632:t=1709573032:v=2:sig=AQFfmR_pWNb7uV_QToZIUYcJ6ZBVwVe1" |
|
| .linkedin.com/ | Name: UserMatchHistory Value: AQKTJ6crHXmeIQAAAY4FV-6OBfCZQ_U-G5BhAU1v48myY9ELD2mzPUtx1U2FGpq4EuwiyTN6BoNpMw |
|
| .linkedin.com/ | Name: AnalyticsSyncHistory Value: AQKLCb0x0YQL7wAAAY4FV-6OuUziQdsw7d9QpvFxvZTCa2KeAZ9D902IrppG9dxL7fBvDnEh1emjIEzua_C1xQ |
|
| .www.linkedin.com/ | Name: bscookie Value: "v=1&202403031723523c0229ae-ec52-4f82-8d4a-b7baad959ddbAQGaeACQi5uO9Y5WgxochqOPfD2ymfQO" |
|
| .linkedin.com/ | Name: li_gc Value: MTswOzE3MDk0ODY2MzI7MjswMjEj6Ci4AjEEHjT6/LpMRux2nx4wvHg7yeiu29ax/Rb66g== |
35 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
account.easyassurance.com.np
px.ads.linkedin.com
px4.ads.linkedin.com
services.promo.ai
snap.licdn.com
url6427.mail.promomailapp.com
www.linkedin.com
13.107.42.14
167.89.123.204
18.239.50.65
2620:1ec:21::14
2a02:26f0:3500:16::215:148f
69.57.172.27
2e1413106208cd1cc8d6c15440863a21d797ee84941cfeb64516c02cd7e8c108
35e685fa125f3d3f6e6117b2eb4917baadd23541ec211659bb1584feb9156829
3e57dc047a95ea941077c28befb712793232329438f71ff0eaba6fab616b5212
55d30960d328b00ff34a0e13e0bca686c4523d54749c58673d36502214dca92c
5fbd2b4fd6e43d878cf0395495ab4ea690d64c02efb48b50cba7faec42bbf0ac
758811c5883d37fecd421ac3db09b502e479aa6cd992ec567015d76280378092
c12d636cb5268c2f7f86c34ec5b1af2826a685eae5e503aece3c477fdd97a971
c59f156ddd70507f05267dc35e2e4f3e44467b9ef414995abb91589dc486dd6a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ee0937e73e9e680905759f1435fee28ddafeb4433ae8de2aee32a2539ad21f97