artella.uk Open in urlscan Pro
45.158.12.227 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://artella.uk/css/skins/yarbi/BNKID/02LLKIDU/W039IKU/RP83UUEI/confirm.html
Submission: On August 15 via automatic, source openphish (August 15th 2024, 2:14:37 pm UTC) — Scanned from DE

Summary HTTP 7 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 7 HTTP transactions. The main IP is 45.158.12.227, located in Izmir, Turkey and belongs to OWEB, TR. The main domain is artella.uk.
TLS certificate: Issued by R10 on July 29th 2024. Valid for: 3 months.

This is the only time artella.uk was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Visa (Financial)

Domain & IP information

	IP Address	AS Autonomous System
6	45.158.12.227 45.158.12.227	211871 (OWEB) (OWEB)
1	139.112.170.16 139.112.170.16	5619 (EVRY-NO T...) (EVRY-NO TietoEVRY Norway)
7	3

6 45.158.12.227 (Izmir, Turkey)

ASN211871 (OWEB, TR)
PTR: static.245.158.12.227.odeaweb.com

artella.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 139.112.170.16 (Fredrikstad, Norway)

ASN5619 (EVRY-NO TietoEVRY Norway, NO)

secure.edb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	artella.uk artella.uk	81 KB
1	edb.com secure.edb.com	2 KB
7	2

	Domain	Requested by
6	artella.uk	artella.uk
1	secure.edb.com
7	2

This site contains no links.

Subject Issuer	Validity	Valid
artella.uk R10	`2024-07-29` - `2024-10-27`	3 months	crt.sh
secure.edb.com Buypass Class 3 CA 2	`2024-03-21` - `2025-04-06`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://artella.uk/css/skins/yarbi/BNKID/02LLKIDU/W039IKU/RP83UUEI/confirm.html
Frame ID: 5379C99D5B6BFE27FA47D02580B2236E
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

BankID

Page Statistics

7
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

82 kB
Transfer

107 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
6 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request confirm.html Show response
artella.uk/css/skins/yarbi/BNKID/02LLKIDU/W039IKU/RP83UUEI/ 22 KB
8 KB 336ms
97ms Document
text/html 45.158.12.227
OWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://artella.uk/css/skins/yarbi/BNKID/02LLKIDU/W039IKU/RP83UUEI/confirm.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 45.158.12.227 Izmir, Turkey, ASN211871 (OWEB, TR),
Reverse DNS: static.245.158.12.227.odeaweb.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 738bc0cb706a7498335c7b5640f8fe4412ad60c073036791d11ce7cd69435af5

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: br
content-length: 7980
content-type: text/html
date: Thu, 15 Aug 2024 14:14:33 GMT
etag: "01dd3de57a3d91:0"
last-modified: Tue, 20 Jun 2023 09:16:18 GMT
server: Microsoft-IIS/10.0
vary: Accept-Encoding
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin

GET
H2 200 common_auth.css
artella.uk/css/skins/yarbi/BNKID/02LLKIDU/W039IKU/RP83UUEI/src/ 9 KB
9 KB 99ms
98ms Stylesheet
text/css 45.158.12.227
OWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://artella.uk/css/skins/yarbi/BNKID/02LLKIDU/W039IKU/RP83UUEI/src/common_auth.css
Requested by: Host: artella.uk
URL: https://artella.uk/css/skins/yarbi/BNKID/02LLKIDU/W039IKU/RP83UUEI/confirm.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 45.158.12.227 Izmir, Turkey, ASN211871 (OWEB, TR),
Reverse DNS: static.245.158.12.227.odeaweb.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 5d4ff4117e8f7f9da541cba635327a05770499b79e51e32e679c2923a4bc27b2

Request headers

Referer: https://artella.uk/css/skins/yarbi/BNKID/02LLKIDU/W039IKU/RP83UUEI/confirm.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-powered-by-plesk: PleskWin
date: Thu, 15 Aug 2024 14:14:33 GMT
last-modified: Tue, 20 Jun 2023 09:16:24 GMT
server: Microsoft-IIS/10.0
etag: "0a466e257a3d91:0"
x-powered-by: ASP.NET
content-type: text/css
accept-ranges: bytes
content-length: 8912

GET
H2 200 bidm.css
artella.uk/css/skins/yarbi/BNKID/02LLKIDU/W039IKU/RP83UUEI/src/ 42 KB
42 KB 275ms
274ms Stylesheet
text/css 45.158.12.227
OWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://artella.uk/css/skins/yarbi/BNKID/02LLKIDU/W039IKU/RP83UUEI/src/bidm.css
Requested by: Host: artella.uk
URL: https://artella.uk/css/skins/yarbi/BNKID/02LLKIDU/W039IKU/RP83UUEI/confirm.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 45.158.12.227 Izmir, Turkey, ASN211871 (OWEB, TR),
Reverse DNS: static.245.158.12.227.odeaweb.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 31412635ed02fd2c9a9ac4c4d9093c0601a687cfe305aba0dea75c1943d7dd72

Request headers

Referer: https://artella.uk/css/skins/yarbi/BNKID/02LLKIDU/W039IKU/RP83UUEI/confirm.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-powered-by-plesk: PleskWin
date: Thu, 15 Aug 2024 14:14:33 GMT
last-modified: Tue, 20 Jun 2023 09:16:24 GMT
server: Microsoft-IIS/10.0
etag: "0a466e257a3d91:0"
x-powered-by: ASP.NET
content-type: text/css
accept-ranges: bytes
content-length: 42882

GET
H2 200 3625.css
artella.uk/css/skins/yarbi/BNKID/02LLKIDU/W039IKU/RP83UUEI/src/ 4 KB
4 KB 96ms
95ms Stylesheet
text/css 45.158.12.227
OWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://artella.uk/css/skins/yarbi/BNKID/02LLKIDU/W039IKU/RP83UUEI/src/3625.css
Requested by: Host: artella.uk
URL: https://artella.uk/css/skins/yarbi/BNKID/02LLKIDU/W039IKU/RP83UUEI/confirm.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 45.158.12.227 Izmir, Turkey, ASN211871 (OWEB, TR),
Reverse DNS: static.245.158.12.227.odeaweb.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 304c378b4700d25f783a2a7d6142c0b4d9dd9df890722064788eee96a12999d8

Request headers

Referer: https://artella.uk/css/skins/yarbi/BNKID/02LLKIDU/W039IKU/RP83UUEI/confirm.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-powered-by-plesk: PleskWin
date: Thu, 15 Aug 2024 14:14:33 GMT
last-modified: Tue, 20 Jun 2023 09:16:24 GMT
server: Microsoft-IIS/10.0
etag: "0a466e257a3d91:0"
x-powered-by: ASP.NET
content-type: text/css
accept-ranges: bytes
content-length: 3940

GET
H2 200 vbm_blu01r.png
artella.uk/css/skins/yarbi/BNKID/02LLKIDU/W039IKU/RP83UUEI/src/ 7 KB
7 KB 184ms
184ms Image
image/png 45.158.12.227
OWEB

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://artella.uk/css/skins/yarbi/BNKID/02LLKIDU/W039IKU/RP83UUEI/src/vbm_blu01r.png
Requested by: Host: artella.uk
URL: https://artella.uk/css/skins/yarbi/BNKID/02LLKIDU/W039IKU/RP83UUEI/confirm.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 45.158.12.227 Izmir, Turkey, ASN211871 (OWEB, TR),
Reverse DNS: static.245.158.12.227.odeaweb.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 6d1a13547d41b9e611e6ca654d8f475b821050539e2bb0714973ac35d67db02f

Request headers

Referer: https://artella.uk/css/skins/yarbi/BNKID/02LLKIDU/W039IKU/RP83UUEI/confirm.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-powered-by-plesk: PleskWin
date: Thu, 15 Aug 2024 14:14:33 GMT
last-modified: Tue, 20 Jun 2023 09:16:24 GMT
server: Microsoft-IIS/10.0
etag: "0a466e257a3d91:0"
x-powered-by: ASP.NET
content-type: image/png
accept-ranges: bytes
content-length: 6770

GET
H2 200 3625_banklogo.jpeg
artella.uk/css/skins/yarbi/BNKID/02LLKIDU/W039IKU/RP83UUEI/src/ 12 KB
12 KB 97ms
97ms Image
image/jpeg 45.158.12.227
OWEB

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://artella.uk/css/skins/yarbi/BNKID/02LLKIDU/W039IKU/RP83UUEI/src/3625_banklogo.jpeg
Requested by: Host: artella.uk
URL: https://artella.uk/css/skins/yarbi/BNKID/02LLKIDU/W039IKU/RP83UUEI/confirm.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 45.158.12.227 Izmir, Turkey, ASN211871 (OWEB, TR),
Reverse DNS: static.245.158.12.227.odeaweb.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 7e0590d63a4ca29f0d4e3e33f38ec65230e70b8b57915d4e6533f8b5e8948fd3

Request headers

Referer: https://artella.uk/css/skins/yarbi/BNKID/02LLKIDU/W039IKU/RP83UUEI/confirm.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-powered-by-plesk: PleskWin
date: Thu, 15 Aug 2024 14:14:33 GMT
last-modified: Tue, 20 Jun 2023 09:16:24 GMT
server: Microsoft-IIS/10.0
etag: "0a466e257a3d91:0"
x-powered-by: ASP.NET
content-type: image/jpeg
accept-ranges: bytes
content-length: 11797

GET
DATA 200
OK truncated
/ 9 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f4eb244555324863a9067686a9e08c9bd7db827ed8dd9a0de8a3cdbc32b66437

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 760 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7f766030e9de9c68acdacfc671963f8cd00ba8783fc9c25e1d3f3319ebbecbd1

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 287 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 747312e0c4caebec5e356cb9de4a170632c78f10e784c644e0fd3b4d48faaac0

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 338 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e9f665238e94d159d8b439ac29f6c644dfd1e1e3843e4f1425943986e1136693

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 898 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7e2036b1455c31bd42d2ad4334698ff9108f7eae94274fa6700df6f13656813f

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/gif

GET
DATA 200
OK truncated
/ 240 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 254868d92f9456d518064051d29f9ff0532bf9a5da291b06f8accb0900e40072

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H/1.1 200
OK 3625.ico
secure.edb.com/static/secure3d/images/common/favicons/ 1 KB
2 KB 257ms
60ms Other
image/x-icon 139.112.170.16
EVRY-NO TietoEVRY...

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.edb.com/static/secure3d/images/common/favicons/3625.ico?v=2021071402

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

139.112.170.16 Fredrikstad, Norway, ASN5619 (EVRY-NO TietoEVRY Norway, NO),

Reverse DNS

Software

Resource Hash

7dc366a210daa822bf1d57acad65c792f1687e8f71318770b1a7c2843e9088a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000

Request headers

Referer: https://artella.uk/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date: Thu, 15 Aug 2024 14:14:33 GMT
Strict-Transport-Security: max-age=2592000
Last-Modified: Thu, 17 Oct 2019 08:44:27 GMT
Content-Type: image/x-icon
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=800
Content-Length: 1150

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Visa (Financial)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

artella.uk
secure.edb.com
139.112.170.16
45.158.12.227
254868d92f9456d518064051d29f9ff0532bf9a5da291b06f8accb0900e40072
304c378b4700d25f783a2a7d6142c0b4d9dd9df890722064788eee96a12999d8
31412635ed02fd2c9a9ac4c4d9093c0601a687cfe305aba0dea75c1943d7dd72
5d4ff4117e8f7f9da541cba635327a05770499b79e51e32e679c2923a4bc27b2
6d1a13547d41b9e611e6ca654d8f475b821050539e2bb0714973ac35d67db02f
738bc0cb706a7498335c7b5640f8fe4412ad60c073036791d11ce7cd69435af5
747312e0c4caebec5e356cb9de4a170632c78f10e784c644e0fd3b4d48faaac0
7dc366a210daa822bf1d57acad65c792f1687e8f71318770b1a7c2843e9088a7
7e0590d63a4ca29f0d4e3e33f38ec65230e70b8b57915d4e6533f8b5e8948fd3
7e2036b1455c31bd42d2ad4334698ff9108f7eae94274fa6700df6f13656813f
7f766030e9de9c68acdacfc671963f8cd00ba8783fc9c25e1d3f3319ebbecbd1
e9f665238e94d159d8b439ac29f6c644dfd1e1e3843e4f1425943986e1136693
f4eb244555324863a9067686a9e08c9bd7db827ed8dd9a0de8a3cdbc32b66437

artella.uk Open in urlscan Pro 45.158.12.227 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

7 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

82 kBTransfer

107 kBSize

0 Cookies

0 Outgoing links

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

artella.uk Open in urlscan Pro
45.158.12.227 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

82 kB
Transfer

107 kB
Size

0
Cookies

7 HTTP transactions
6 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!