skatteetateneu.wpenginepowered.com Open in urlscan Pro
141.193.213.11 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://skatteetateneu.wpenginepowered.com/no/id/perso.html
Submission: On December 11 via manual (December 11th 2024, 9:45:22 am UTC) from NO — Scanned from NO

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 12 HTTP transactions. The main IP is 141.193.213.11, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare London, LLC, US. The main domain is skatteetateneu.wpenginepowered.com.
TLS certificate: Issued by E6 on November 16th 2024. Valid for: 3 months.

This is the only time skatteetateneu.wpenginepowered.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BankID (Banking)

Domain & IP information

	IP Address	AS Autonomous System
10	141.193.213.11 141.193.213.11	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare London)
1	142.250.185.170 142.250.185.170	15169 (GOOGLE) (GOOGLE)
1	95.175.105.204 95.175.105.204	49282 (FICOLO Fi...) (FICOLO Ficolo Oy)
12	3

10 141.193.213.11 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US)

skatteetateneu.wpenginepowered.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.170 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f10.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 95.175.105.204 (Helsinki, Finland)

ASN49282 (FICOLO Ficolo Oy, FI)
PTR: kommunikasjon.ntb.no

kommunikasjon.ntb.no	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	wpenginepowered.com skatteetateneu.wpenginepowered.com	36 KB
1	ntb.no kommunikasjon.ntb.no	6 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 29	1 KB
12	3

	Domain	Requested by
10	skatteetateneu.wpenginepowered.com	skatteetateneu.wpenginepowered.com
1	kommunikasjon.ntb.no
1	fonts.googleapis.com	skatteetateneu.wpenginepowered.com
12	3

This site contains no links.

Subject Issuer	Validity	Valid
wpenginepowered.com E6	`2024-11-16` - `2025-02-14`	3 months	crt.sh
upload.video.google.com WR2	`2024-11-04` - `2025-01-27`	3 months	crt.sh
kommunikasjon.ntb.no R10	`2024-10-28` - `2025-01-26`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://skatteetateneu.wpenginepowered.com/no/id/perso.html
Frame ID: A8552B8690BAE3F753ACE85726BEE52A
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

NORGE AS

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

44 kB
Transfer

234 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 Primary Request perso.html Show response
skatteetateneu.wpenginepowered.com/no/id/ 3 KB
1 KB 1114ms
1005ms Document
text/html 141.193.213.11
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://skatteetateneu.wpenginepowered.com/no/id/perso.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.11 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4431562fed5bf82688d75df8ad40b1e4bd42b67cb8c573f132bcc1326fc779cc

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: max-age=600, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 8f048a5aaaf37062-GOT
content-encoding: br
content-type: text/html
date: Wed, 11 Dec 2024 09:45:13 GMT
last-modified: Wed, 11 Dec 2024 09:15:51 GMT
priority: u=0,i
server: cloudflare
server-timing: cfExtPri
vary: Accept-Encoding Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
x-cache: MISS
x-cache-group: iphone
x-cacheable: SHORT

GET
H3 200 bootstrap.css
skatteetateneu.wpenginepowered.com/no/id/css/ 189 KB
26 KB 516ms
514ms Stylesheet
text/css 141.193.213.11
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://skatteetateneu.wpenginepowered.com/no/id/css/bootstrap.css
Requested by: Host: skatteetateneu.wpenginepowered.com
URL: https://skatteetateneu.wpenginepowered.com/no/id/perso.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.11 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 823d30ccfd5ba5d3e5c1efbd67b15390d49d8e0b4cfb36335057821778686917

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://skatteetateneu.wpenginepowered.com/no/id/perso.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"67595847-2f22a"
age: 0
cf-ray: 8f048a60f9a67062-GOT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 11 Dec 2024 09:45:13 GMT
content-type: text/css
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare
last-modified: Wed, 11 Dec 2024 09:15:51 GMT
priority: u=0,i=?0

GET
H3 200 lary.css
skatteetateneu.wpenginepowered.com/no/id/css/ 10 KB
2 KB 291ms
290ms Stylesheet
text/css 141.193.213.11
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://skatteetateneu.wpenginepowered.com/no/id/css/lary.css
Requested by: Host: skatteetateneu.wpenginepowered.com
URL: https://skatteetateneu.wpenginepowered.com/no/id/perso.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.11 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 26b09af686038eff10a161b0e3b88d0c311b829aee42126ca1d915a48018d8c6

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://skatteetateneu.wpenginepowered.com/no/id/perso.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"67595847-279f"
age: 0
cf-ray: 8f048a6109af7062-GOT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 11 Dec 2024 09:45:13 GMT
content-type: text/css
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare
last-modified: Wed, 11 Dec 2024 09:15:51 GMT
priority: u=0,i=?0

GET
H3 200 acc.svg
skatteetateneu.wpenginepowered.com/no/id/image/ 2 KB
973 B 299ms
298ms Image
image/svg+xml 141.193.213.11
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://skatteetateneu.wpenginepowered.com/no/id/image/acc.svg
Requested by: Host: skatteetateneu.wpenginepowered.com
URL: https://skatteetateneu.wpenginepowered.com/no/id/perso.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.11 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2135db17253f889e03a392ec096f45b3a79cdb97b498841a698b2bf4a54e1bb4

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://skatteetateneu.wpenginepowered.com/no/id/perso.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"67595847-824"
age: 0
cf-ray: 8f048a6109b07062-GOT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 11 Dec 2024 09:45:13 GMT
content-type: image/svg+xml
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare
last-modified: Wed, 11 Dec 2024 09:15:51 GMT
priority: u=2,i

GET
H3 200 bar_lg.png
skatteetateneu.wpenginepowered.com/no/id/image/ 388 B
659 B 298ms
298ms Image
image/webp 141.193.213.11
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://skatteetateneu.wpenginepowered.com/no/id/image/bar_lg.png
Requested by: Host: skatteetateneu.wpenginepowered.com
URL: https://skatteetateneu.wpenginepowered.com/no/id/perso.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.11 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fd28b6a30856cd02cca7ef9c08733be740e18f4e4e75867267bf4e513e3f86f9

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://skatteetateneu.wpenginepowered.com/no/id/perso.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cf-bgj: imgq:100,h2pri
etag: "67595847-374"
age: 0
cf-cache-status: HIT
cf-polished: origFmt=png, origSize=884
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 11 Dec 2024 09:45:13 GMT
content-type: image/webp
content-disposition: inline; filename="bar_lg.webp"
vary: Accept
last-modified: Wed, 11 Dec 2024 09:15:51 GMT
priority: u=2,i
cache-control: public, max-age=31536000
cf-ray: 8f048a6109b27062-GOT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 388
server: cloudflare

GET
H3 200 sahm.svg
skatteetateneu.wpenginepowered.com/no/id/image/ 172 B
361 B 752ms
751ms Image
image/svg+xml 141.193.213.11
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://skatteetateneu.wpenginepowered.com/no/id/image/sahm.svg
Requested by: Host: skatteetateneu.wpenginepowered.com
URL: https://skatteetateneu.wpenginepowered.com/no/id/perso.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.11 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4dca530d4682ddf6f4b9053173c007f95875c2634a6b61c9573d93fc21483766

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://skatteetateneu.wpenginepowered.com/no/id/perso.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

cache-control: public, max-age=31536000
content-encoding: br
cf-cache-status: MISS
etag: W/"67595844-ac"
cf-ray: 8f048a62fbc27062-GOT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 11 Dec 2024 09:45:14 GMT
content-type: image/svg+xml
vary: Accept-Encoding, Accept-Encoding
server: cloudflare
last-modified: Wed, 11 Dec 2024 09:15:48 GMT
priority: u=2,i

GET
H3 200 protege.png
skatteetateneu.wpenginepowered.com/no/id/image/ 5 KB
5 KB 720ms
719ms Image
image/png 141.193.213.11
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://skatteetateneu.wpenginepowered.com/no/id/image/protege.png
Requested by: Host: skatteetateneu.wpenginepowered.com
URL: https://skatteetateneu.wpenginepowered.com/no/id/perso.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.11 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cba05bfbcf9755ce28b86a2fca72718d2e821af148b7a856776edd8cca755c48

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://skatteetateneu.wpenginepowered.com/no/id/perso.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

server: cloudflare
cache-control: public, max-age=31536000
cf-cache-status: MISS
etag: "67595844-12f5"
cf-ray: 8f048a62fbc57062-GOT
accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 4853
server-timing: cfExtPri
date: Wed, 11 Dec 2024 09:45:14 GMT
content-type: image/png
last-modified: Wed, 11 Dec 2024 09:15:48 GMT
vary: Accept-Encoding
priority: u=2,i

GET
H3 404 jquery-3.5.1.min.js
skatteetateneu.wpenginepowered.com/no/id/js/ 0
0 103ms
103ms Script
text/html 141.193.213.11
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://skatteetateneu.wpenginepowered.com/no/id/js/jquery-3.5.1.min.js
Requested by: Host: skatteetateneu.wpenginepowered.com
URL: https://skatteetateneu.wpenginepowered.com/no/id/perso.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.11 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://skatteetateneu.wpenginepowered.com/no/id/perso.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
cf-cache-status: HIT
age: 1
cf-ray: 8f048a6799057062-GOT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 11 Dec 2024 09:45:14 GMT
content-type: text/html
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare
priority: u=2,i=?0

GET
H3 404 jquery.mask.js
skatteetateneu.wpenginepowered.com/no/id/js/ 0
0 81ms
77ms Script
text/html 141.193.213.11
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://skatteetateneu.wpenginepowered.com/no/id/js/jquery.mask.js
Requested by: Host: skatteetateneu.wpenginepowered.com
URL: https://skatteetateneu.wpenginepowered.com/no/id/perso.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.11 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://skatteetateneu.wpenginepowered.com/no/id/perso.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
cf-cache-status: HIT
age: 1
cf-ray: 8f048a67e94e7062-GOT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 11 Dec 2024 09:45:14 GMT
content-type: text/html
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare
priority: u=2,i=?0

GET
H2 200 css2
fonts.googleapis.com/ 19 KB
1 KB 756ms
102ms Stylesheet
text/css 142.250.185.170
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Wix+Madefor+Text:ital,wght@0,400;0,500;0,600;0,700;0,800;1,400;1,500;1,600;1,700;1,800&display=swap

Requested by

Host: skatteetateneu.wpenginepowered.com
URL: https://skatteetateneu.wpenginepowered.com/no/id/css/lary.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.170 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f10.1e100.net

Software

ESF /

Resource Hash

af149a3bd3453977e6a908a2375f1c012bb8cff3de05709af5b0bb1a5c9e7506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://skatteetateneu.wpenginepowered.com/
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Wed, 11 Dec 2024 09:45:14 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 11 Dec 2024 09:45:14 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Wed, 11 Dec 2024 09:45:14 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 95f3a80b-ceb5-4afb-9e0a-d1611744ba4d-w_300_h_250.jpg
kommunikasjon.ntb.no/data/images/00306/ 6 KB
6 KB 536ms
69ms Other
image/jpeg 95.175.105.204
FICOLO Ficolo Oy

General

Check archive.org

Show headers Download Go to

Full URL

https://kommunikasjon.ntb.no/data/images/00306/95f3a80b-ceb5-4afb-9e0a-d1611744ba4d-w_300_h_250.jpg

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.175.105.204 Helsinki, Finland, ASN49282 (FICOLO Ficolo Oy, FI),

Reverse DNS

kommunikasjon.ntb.no

Software

nginx /

Resource Hash

425b9ac25db41d127ce9ec8871f06cfbfdefbca4e9c91f1dc401e9ec3cebdddd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://skatteetateneu.wpenginepowered.com/
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

x-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
referrer-policy: strict-origin-when-cross-origin
cache-control: max-age=2592000
etag: W/"12533788021"
access-control-allow-methods: POST, PUT, GET, DELETE, OPTIONS
x-prs-image-width: 208
expires: Fri, 10 Jan 2025 09:45:14 GMT
access-control-allow-origin: https://kommunikasjon.ntb.no
content-length: 5707
date: Wed, 11 Dec 2024 09:45:14 GMT
content-type: image/jpeg
server: nginx
x-prs-image-height: 250
access-control-allow-headers: Accept, Accept-Language, Content-Language, Content-Type, Origin

GET
H3 404 favicon.20f0cd89.ico
skatteetateneu.wpenginepowered.com/no/source/ 548 B
326 B 787ms
787ms Other
text/html 141.193.213.11
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://skatteetateneu.wpenginepowered.com/no/source/favicon.20f0cd89.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.11 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare London, LLC, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://skatteetateneu.wpenginepowered.com/no/id/perso.html
User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
cf-cache-status: HIT
age: 0
cf-ray: 8f048a6c5e097062-GOT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 11 Dec 2024 09:45:15 GMT
content-type: text/html
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
server: cloudflare
priority: u=1,i

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BankID (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://skatteetateneu.wpenginepowered.com/no/id/js/jquery-3.5.1.min.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://skatteetateneu.wpenginepowered.com/no/id/js/jquery.mask.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://skatteetateneu.wpenginepowered.com/no/source/favicon.20f0cd89.ico Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
kommunikasjon.ntb.no
skatteetateneu.wpenginepowered.com
141.193.213.11
142.250.185.170
95.175.105.204
2135db17253f889e03a392ec096f45b3a79cdb97b498841a698b2bf4a54e1bb4
26b09af686038eff10a161b0e3b88d0c311b829aee42126ca1d915a48018d8c6
425b9ac25db41d127ce9ec8871f06cfbfdefbca4e9c91f1dc401e9ec3cebdddd
4431562fed5bf82688d75df8ad40b1e4bd42b67cb8c573f132bcc1326fc779cc
4dca530d4682ddf6f4b9053173c007f95875c2634a6b61c9573d93fc21483766
823d30ccfd5ba5d3e5c1efbd67b15390d49d8e0b4cfb36335057821778686917
af149a3bd3453977e6a908a2375f1c012bb8cff3de05709af5b0bb1a5c9e7506
cba05bfbcf9755ce28b86a2fca72718d2e821af148b7a856776edd8cca755c48
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090
fd28b6a30856cd02cca7ef9c08733be740e18f4e4e75867267bf4e513e3f86f9

skatteetateneu.wpenginepowered.com Open in urlscan Pro 141.193.213.11 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

12 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

44 kBTransfer

234 kBSize

0 Cookies

0 Outgoing links

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

3 Console Messages

Indicators

skatteetateneu.wpenginepowered.com Open in urlscan Pro
141.193.213.11 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

44 kB
Transfer

234 kB
Size

0
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!