nordeafinalnd.dhakapdm.com Open in urlscan Pro
65.21.170.252 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://romersaecuador.com/js/1
Effective URL:
https://nordeafinalnd.dhakapdm.com/js/nordea/main/login.html
Submission: On August 22 via manual (August 22nd 2024, 5:03:27 am UTC) from FI — Scanned from FI

Summary HTTP 1 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 1 HTTP transactions. The main IP is 65.21.170.252, located in Helsinki, Finland and belongs to HETZNER-AS, DE. The main domain is nordeafinalnd.dhakapdm.com.
TLS certificate: Issued by R11 on August 22nd 2024. Valid for: 3 months.

This is the only time nordeafinalnd.dhakapdm.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Nordea (Banking)

Domain & IP information

	IP Address	AS Autonomous System
2 2	68.66.224.47 68.66.224.47	55293 (A2HOSTING) (A2HOSTING)
1	65.21.170.252 65.21.170.252	24940 (HETZNER-AS) (HETZNER-AS)
1	2

2 68.66.224.47 (United States) 2 redirects

ASN55293 (A2HOSTING, US)
PTR: az1-ss23.a2hosting.com

romersaecuador.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.21.170.252 (Helsinki, Finland)

ASN24940 (HETZNER-AS, DE)
PTR: server9.hostingbangladesh.com

nordeafinalnd.dhakapdm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	romersaecuador.com 2 redirects romersaecuador.com	805 B
1	dhakapdm.com nordeafinalnd.dhakapdm.com	329 KB
1	2

	Domain	Requested by
2	romersaecuador.com	2 redirects
1	nordeafinalnd.dhakapdm.com
1	2

This site contains links to these domains. Also see Links.

Domain
www.nordea.fi

Subject Issuer	Validity	Valid
nordeafinalnd.dhakapdm.com R11	`2024-08-22` - `2024-11-20`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://nordeafinalnd.dhakapdm.com/js/nordea/main/login.html
Frame ID: 4464E0EC5E47A0B911FAD7AC6FA64F55
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Nordea - Tunnistautuminen

Page URL History Show full URLs

https://romersaecuador.com/js/1 HTTP 301
https://romersaecuador.com/js/1/ HTTP 302
https://nordeafinalnd.dhakapdm.com/js/nordea/main/login.html Page URL

Page Statistics

1
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

391 kB
Transfer

604 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.nordea.fi/nordea-id
Title: www.nordea.fi

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://romersaecuador.com/js/1 HTTP 301
https://romersaecuador.com/js/1/ HTTP 302
https://nordeafinalnd.dhakapdm.com/js/nordea/main/login.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

1 HTTP transactions
10 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request login.html Show response nordeafinalnd.dhakapdm.com/js/nordea/main/ Redirect Chain https://romersaecuador.com/js/1 https://romersaecuador.com/js/1/ https://nordeafinalnd.dhakapdm.com/js/nordea/main/login.html	465 KB 329 KB	800ms 227ms	Document text/html	65.21.170.252 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://nordeafinalnd.dhakapdm.com/js/nordea/main/login.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.21.170.252 Helsinki, Finland, ASN24940 (HETZNER-AS, DE), Reverse DNS server9.hostingbangladesh.com Software LiteSpeed / Resource Hash `d4c30bd94037abad793ed19a84f76aed45126202a1450d454b1b9000d44953d2` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-encoding br content-length 336761 content-type text/html date Thu, 22 Aug 2024 05:03:22 GMT last-modified Fri, 16 Aug 2024 04:09:38 GMT server LiteSpeed vary Accept-Encoding,User-Agent Redirect headers Connection Keep-Alive Content-Length 0 Content-Type text/html; charset=UTF-8 Date Thu, 22 Aug 2024 05:03:21 GMT Keep-Alive timeout=3, max=499 Server Apache Strict-Transport-Security max-age=63072000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Powered-By PHP/8.2.22 location https://nordeafinalnd.dhakapdm.com/js/nordea/main/login.html
GET DATA	200 OK	truncated /	1 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `b88b6130e6d786e3793f9811c6ad215e23237c3875b1bd85330505dc8ff350f9` Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	1 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `9dce5d117feaa37a56f57d332e48c012e56e5569dac7cab55a28305587624a24` Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	671 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `23c76e6a9df05e6f95e1384fbf5566300447cf8a2e658af4de19bb52c14eeadf` Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	724 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `c137f1432d58dec0f7fde518cf820bd45ffb9473b662f60d09ff676c29c1ecf7` Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	961 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `97f27f25912f72cb94fdb45b5bf833a6280754167831c74fc8bed9483ef5ac8b` Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	67 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `836393ac52708bd75b2e1c88defb51faa58f0fdfa374d57d2529e0a6554882ff` Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	30 KB 30 KB		Font application/font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `21a2a17b532837aeafeb95de9f252bfec714028517f79fb4143845ca4d23353c` Request headers Referer Origin https://nordeafinalnd.dhakapdm.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers Content-Type application/font-woff
GET DATA	200 OK	truncated /	2 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `f0dd565f9257ed5f2b92bcdf9fffeb6b057829269c5a5c60033f89402b372b1a` Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	4 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `9f447470aba212c3bf9d926893df1219f82f5ea14fb495658af56d6ab22c9697` Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	31 KB 31 KB		Font application/font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `ff28a732b1fc6a547797b7a9a7c29025ae41b74cc5e208232418d9c41fb43c44` Request headers Referer Origin https://nordeafinalnd.dhakapdm.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers Content-Type application/font-woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Nordea (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

nordeafinalnd.dhakapdm.com
romersaecuador.com
65.21.170.252
68.66.224.47
21a2a17b532837aeafeb95de9f252bfec714028517f79fb4143845ca4d23353c
23c76e6a9df05e6f95e1384fbf5566300447cf8a2e658af4de19bb52c14eeadf
836393ac52708bd75b2e1c88defb51faa58f0fdfa374d57d2529e0a6554882ff
97f27f25912f72cb94fdb45b5bf833a6280754167831c74fc8bed9483ef5ac8b
9dce5d117feaa37a56f57d332e48c012e56e5569dac7cab55a28305587624a24
9f447470aba212c3bf9d926893df1219f82f5ea14fb495658af56d6ab22c9697
b88b6130e6d786e3793f9811c6ad215e23237c3875b1bd85330505dc8ff350f9
c137f1432d58dec0f7fde518cf820bd45ffb9473b662f60d09ff676c29c1ecf7
d4c30bd94037abad793ed19a84f76aed45126202a1450d454b1b9000d44953d2
f0dd565f9257ed5f2b92bcdf9fffeb6b057829269c5a5c60033f89402b372b1a
ff28a732b1fc6a547797b7a9a7c29025ae41b74cc5e208232418d9c41fb43c44

nordeafinalnd.dhakapdm.com Open in urlscan Pro 65.21.170.252 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

1 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

391 kBTransfer

604 kBSize

0 Cookies

1 Outgoing links

Page URL History

Redirected requests

1 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 10 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

nordeafinalnd.dhakapdm.com Open in urlscan Pro
65.21.170.252 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

1
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

391 kB
Transfer

604 kB
Size

0
Cookies

1 HTTP transactions
10 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!