noskatteetaten.wpenginepowered.com Open in urlscan Pro
141.193.213.10 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://noskatteetaten.wpenginepowered.com/no/id/acp.html
Submission: On December 11 via manual (December 11th 2024, 7:27:37 am UTC) from NO — Scanned from NO

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 13 HTTP transactions. The main IP is 141.193.213.10, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare London, LLC, US. The main domain is noskatteetaten.wpenginepowered.com.
TLS certificate: Issued by E6 on November 16th 2024. Valid for: 3 months.

This is the only time noskatteetaten.wpenginepowered.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BankID (Banking)

Domain & IP information

	IP Address	AS Autonomous System
11	141.193.213.10 141.193.213.10	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare London)
1	216.58.206.42 216.58.206.42	15169 (GOOGLE) (GOOGLE)
1	95.175.105.204 95.175.105.204	49282 (FICOLO Fi...) (FICOLO Ficolo Oy)
13	3

11 141.193.213.10 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US)

noskatteetaten.wpenginepowered.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.206.42 (United States)

ASN15169 (GOOGLE, US)
PTR: lcfraa-aa-in-f10.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 95.175.105.204 (Helsinki, Finland)

ASN49282 (FICOLO Ficolo Oy, FI)
PTR: kommunikasjon.ntb.no

kommunikasjon.ntb.no	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	wpenginepowered.com noskatteetaten.wpenginepowered.com	35 KB
1	ntb.no kommunikasjon.ntb.no	6 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 29	1 KB
13	3

	Domain	Requested by
11	noskatteetaten.wpenginepowered.com	noskatteetaten.wpenginepowered.com
1	kommunikasjon.ntb.no
1	fonts.googleapis.com	noskatteetaten.wpenginepowered.com
13	3

This site contains no links.

Subject Issuer	Validity	Valid
wpenginepowered.com E6	`2024-11-16` - `2025-02-14`	3 months	crt.sh
upload.video.google.com WR2	`2024-11-04` - `2025-01-27`	3 months	crt.sh
kommunikasjon.ntb.no R10	`2024-10-28` - `2025-01-26`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://noskatteetaten.wpenginepowered.com/no/id/acp.html
Frame ID: 4CA2CFBB62725750E40286E1BE0DF71B
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

NORGE AS

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

13
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

43 kB
Transfer

233 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 Primary Request acp.html Show response
noskatteetaten.wpenginepowered.com/no/id/ 4 KB
1 KB 456ms
310ms Document
text/html 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://noskatteetaten.wpenginepowered.com/no/id/acp.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d67c75de16aa03e74d540557e9f1860ce843dda299b296a31c8470162d03d094

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: max-age=600, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 8f03c0b25c3e5f19-ARN
content-encoding: br
content-type: text/html
date: Wed, 11 Dec 2024 07:27:32 GMT
last-modified: Wed, 11 Dec 2024 01:32:04 GMT
priority: u=0,i
server: cloudflare
server-timing: cfExtPri
vary: Accept-Encoding Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
x-cache: MISS
x-cache-group: iphone
x-cacheable: SHORT

GET
H3 200 bootstrap.css
noskatteetaten.wpenginepowered.com/no/id/css/ 189 KB
26 KB 84ms
83ms Stylesheet
text/css 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://noskatteetaten.wpenginepowered.com/no/id/css/bootstrap.css
Requested by: Host: noskatteetaten.wpenginepowered.com
URL: https://noskatteetaten.wpenginepowered.com/no/id/acp.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 823d30ccfd5ba5d3e5c1efbd67b15390d49d8e0b4cfb36335057821778686917

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://noskatteetaten.wpenginepowered.com/no/id/acp.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"6758eb94-2f22a"
age: 18965
cf-ray: 8f03c0b45e745f19-ARN
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 11 Dec 2024 07:27:32 GMT
content-type: text/css
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare
last-modified: Wed, 11 Dec 2024 01:32:04 GMT
priority: u=0,i=?0

GET
H3 200 lary.css
noskatteetaten.wpenginepowered.com/no/id/css/ 10 KB
2 KB 77ms
76ms Stylesheet
text/css 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://noskatteetaten.wpenginepowered.com/no/id/css/lary.css
Requested by: Host: noskatteetaten.wpenginepowered.com
URL: https://noskatteetaten.wpenginepowered.com/no/id/acp.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 26b09af686038eff10a161b0e3b88d0c311b829aee42126ca1d915a48018d8c6

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://noskatteetaten.wpenginepowered.com/no/id/acp.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"6758eb94-279f"
age: 18965
cf-ray: 8f03c0b45e7d5f19-ARN
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 11 Dec 2024 07:27:32 GMT
content-type: text/css
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare
last-modified: Wed, 11 Dec 2024 01:32:04 GMT
priority: u=0,i=?0

GET
H3 200 acc.svg
noskatteetaten.wpenginepowered.com/no/id/image/ 2 KB
978 B 79ms
78ms Image
image/svg+xml 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://noskatteetaten.wpenginepowered.com/no/id/image/acc.svg
Requested by: Host: noskatteetaten.wpenginepowered.com
URL: https://noskatteetaten.wpenginepowered.com/no/id/acp.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2135db17253f889e03a392ec096f45b3a79cdb97b498841a698b2bf4a54e1bb4

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://noskatteetaten.wpenginepowered.com/no/id/acp.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"6758eb94-824"
age: 18958
cf-ray: 8f03c0b45e7e5f19-ARN
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 11 Dec 2024 07:27:32 GMT
content-type: image/svg+xml
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare
last-modified: Wed, 11 Dec 2024 01:32:04 GMT
priority: u=2,i

GET
H3 200 bar_lg.png
noskatteetaten.wpenginepowered.com/no/id/image/ 388 B
664 B 79ms
79ms Image
image/webp 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://noskatteetaten.wpenginepowered.com/no/id/image/bar_lg.png
Requested by: Host: noskatteetaten.wpenginepowered.com
URL: https://noskatteetaten.wpenginepowered.com/no/id/acp.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fd28b6a30856cd02cca7ef9c08733be740e18f4e4e75867267bf4e513e3f86f9

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://noskatteetaten.wpenginepowered.com/no/id/acp.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cf-bgj: imgq:100,h2pri
etag: "6758eb94-374"
age: 18958
cf-cache-status: HIT
cf-polished: origFmt=png, origSize=884
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 11 Dec 2024 07:27:32 GMT
content-type: image/webp
content-disposition: inline; filename="bar_lg.webp"
vary: Accept
last-modified: Wed, 11 Dec 2024 01:32:04 GMT
priority: u=2,i
cache-control: public, max-age=31536000
cf-ray: 8f03c0b45e815f19-ARN
accept-ranges: bytes
access-control-allow-origin: *
content-length: 388
server: cloudflare

GET
H3 200 info.svg
noskatteetaten.wpenginepowered.com/no/id/image/ 760 B
709 B 69ms
68ms Image
image/svg+xml 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://noskatteetaten.wpenginepowered.com/no/id/image/info.svg
Requested by: Host: noskatteetaten.wpenginepowered.com
URL: https://noskatteetaten.wpenginepowered.com/no/id/acp.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7f766030e9de9c68acdacfc671963f8cd00ba8783fc9c25e1d3f3319ebbecbd1

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://noskatteetaten.wpenginepowered.com/no/id/acp.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"6758eb94-2f8"
age: 18946
cf-ray: 8f03c0b4df305f19-ARN
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 11 Dec 2024 07:27:32 GMT
content-type: image/svg+xml
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare
last-modified: Wed, 11 Dec 2024 01:32:04 GMT
priority: u=2,i

GET
H3 200 loading.gif
noskatteetaten.wpenginepowered.com/no/id/image/ 891 B
1 KB 72ms
71ms Image
image/gif 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://noskatteetaten.wpenginepowered.com/no/id/image/loading.gif
Requested by: Host: noskatteetaten.wpenginepowered.com
URL: https://noskatteetaten.wpenginepowered.com/no/id/acp.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9a653e3112fc0cd1bc2e5355f3d67b69b01f2b81d5947ae348389ce4a8c890b9

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://noskatteetaten.wpenginepowered.com/no/id/acp.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cf-bgj: imgq:100,h2pri
etag: "6758eb8d-382"
age: 18946
cf-cache-status: HIT
cf-polished: origSize=898, status=webp_bigger
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 11 Dec 2024 07:27:32 GMT
content-type: image/gif
last-modified: Wed, 11 Dec 2024 01:31:57 GMT
vary: Accept-Encoding
priority: u=2,i
cache-control: public, max-age=31536000
cf-ray: 8f03c0b4ef365f19-ARN
accept-ranges: bytes
access-control-allow-origin: *
content-length: 891
server: cloudflare

GET
H3 200 protege.png
noskatteetaten.wpenginepowered.com/no/id/image/ 2 KB
3 KB 75ms
75ms Image
image/png 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://noskatteetaten.wpenginepowered.com/no/id/image/protege.png
Requested by: Host: noskatteetaten.wpenginepowered.com
URL: https://noskatteetaten.wpenginepowered.com/no/id/acp.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 375aa9cbfaf03a02679363d4967f662930ea9eb9bc7e75e1ae50e5bd105844fc

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://noskatteetaten.wpenginepowered.com/no/id/acp.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cf-bgj: imgq:100,h2pri
etag: "6758eb8d-12f5"
age: 18958
cf-cache-status: HIT
cf-polished: origSize=4853, status=webp_bigger
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 11 Dec 2024 07:27:32 GMT
content-type: image/png
last-modified: Wed, 11 Dec 2024 01:31:57 GMT
vary: Accept-Encoding
priority: u=2,i
cache-control: public, max-age=31536000
cf-ray: 8f03c0b54fa15f19-ARN
accept-ranges: bytes
access-control-allow-origin: *
content-length: 2381
server: cloudflare

GET
H3 404 jquery-3.5.1.min.js
noskatteetaten.wpenginepowered.com/no/id/js/ 0
0 974ms
973ms Script
text/html 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://noskatteetaten.wpenginepowered.com/no/id/js/jquery-3.5.1.min.js
Requested by: Host: noskatteetaten.wpenginepowered.com
URL: https://noskatteetaten.wpenginepowered.com/no/id/acp.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://noskatteetaten.wpenginepowered.com/no/id/acp.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
cf-cache-status: EXPIRED
cf-ray: 8f03c0b54fa65f19-ARN
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 11 Dec 2024 07:27:33 GMT
content-type: text/html
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare
priority: u=2,i=?0

GET
H3 404 jquery.mask.js
noskatteetaten.wpenginepowered.com/no/id/js/ 0
0 826ms
826ms Script
text/html 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://noskatteetaten.wpenginepowered.com/no/id/js/jquery.mask.js
Requested by: Host: noskatteetaten.wpenginepowered.com
URL: https://noskatteetaten.wpenginepowered.com/no/id/acp.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://noskatteetaten.wpenginepowered.com/no/id/acp.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
cf-cache-status: EXPIRED
cf-ray: 8f03c0b5c8245f19-ARN
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 11 Dec 2024 07:27:33 GMT
content-type: text/html
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare
priority: u=2,i=?0

GET
H2 200 css2
fonts.googleapis.com/ 19 KB
1 KB 600ms
128ms Stylesheet
text/css 216.58.206.42
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Wix+Madefor+Text:ital,wght@0,400;0,500;0,600;0,700;0,800;1,400;1,500;1,600;1,700;1,800&display=swap

Requested by

Host: noskatteetaten.wpenginepowered.com
URL: https://noskatteetaten.wpenginepowered.com/no/id/css/lary.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.42 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lcfraa-aa-in-f10.1e100.net

Software

ESF /

Resource Hash

af149a3bd3453977e6a908a2375f1c012bb8cff3de05709af5b0bb1a5c9e7506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://noskatteetaten.wpenginepowered.com/
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Wed, 11 Dec 2024 07:27:33 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 11 Dec 2024 07:27:33 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Wed, 11 Dec 2024 07:27:33 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 95f3a80b-ceb5-4afb-9e0a-d1611744ba4d-w_300_h_250.jpg
kommunikasjon.ntb.no/data/images/00306/ 6 KB
6 KB 252ms
90ms Other
image/jpeg 95.175.105.204
FICOLO Ficolo Oy

General

Check archive.org

Show headers Download Go to

Full URL

https://kommunikasjon.ntb.no/data/images/00306/95f3a80b-ceb5-4afb-9e0a-d1611744ba4d-w_300_h_250.jpg

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.175.105.204 Helsinki, Finland, ASN49282 (FICOLO Ficolo Oy, FI),

Reverse DNS

kommunikasjon.ntb.no

Software

nginx /

Resource Hash

425b9ac25db41d127ce9ec8871f06cfbfdefbca4e9c91f1dc401e9ec3cebdddd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://noskatteetaten.wpenginepowered.com/
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
referrer-policy: strict-origin-when-cross-origin
cache-control: max-age=2592000
etag: W/"12533788021"
access-control-allow-methods: POST, PUT, GET, DELETE, OPTIONS
x-prs-image-width: 208
expires: Fri, 10 Jan 2025 07:27:33 GMT
access-control-allow-origin: https://kommunikasjon.ntb.no
content-length: 5707
date: Wed, 11 Dec 2024 07:27:33 GMT
content-type: image/jpeg
server: nginx
x-prs-image-height: 250
access-control-allow-headers: Accept, Accept-Language, Content-Language, Content-Type, Origin

GET
H3 404 favicon.20f0cd89.ico
noskatteetaten.wpenginepowered.com/no/source/ 548 B
329 B 826ms
826ms Other
text/html 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://noskatteetaten.wpenginepowered.com/no/source/favicon.20f0cd89.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://noskatteetaten.wpenginepowered.com/no/id/acp.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
cf-cache-status: EXPIRED
cf-ray: 8f03c0bd08535f19-ARN
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 11 Dec 2024 07:27:34 GMT
content-type: text/html
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare
priority: u=1,i

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BankID (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://noskatteetaten.wpenginepowered.com/no/id/js/jquery.mask.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://noskatteetaten.wpenginepowered.com/no/id/js/jquery-3.5.1.min.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://noskatteetaten.wpenginepowered.com/no/source/favicon.20f0cd89.ico Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
kommunikasjon.ntb.no
noskatteetaten.wpenginepowered.com
141.193.213.10
216.58.206.42
95.175.105.204
2135db17253f889e03a392ec096f45b3a79cdb97b498841a698b2bf4a54e1bb4
26b09af686038eff10a161b0e3b88d0c311b829aee42126ca1d915a48018d8c6
375aa9cbfaf03a02679363d4967f662930ea9eb9bc7e75e1ae50e5bd105844fc
425b9ac25db41d127ce9ec8871f06cfbfdefbca4e9c91f1dc401e9ec3cebdddd
7f766030e9de9c68acdacfc671963f8cd00ba8783fc9c25e1d3f3319ebbecbd1
823d30ccfd5ba5d3e5c1efbd67b15390d49d8e0b4cfb36335057821778686917
9a653e3112fc0cd1bc2e5355f3d67b69b01f2b81d5947ae348389ce4a8c890b9
af149a3bd3453977e6a908a2375f1c012bb8cff3de05709af5b0bb1a5c9e7506
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090
d67c75de16aa03e74d540557e9f1860ce843dda299b296a31c8470162d03d094
fd28b6a30856cd02cca7ef9c08733be740e18f4e4e75867267bf4e513e3f86f9

noskatteetaten.wpenginepowered.com Open in urlscan Pro 141.193.213.10 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

43 kBTransfer

233 kBSize

0 Cookies

0 Outgoing links

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

3 Console Messages

Indicators

noskatteetaten.wpenginepowered.com Open in urlscan Pro
141.193.213.10 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

43 kB
Transfer

233 kB
Size

0
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!