billiroksgold.cleverapps.io Open in urlscan Pro
185.42.117.192 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://bit.ly/Verification-MitID
Effective URL:
https://billiroksgold.cleverapps.io/mit/mit/login.php?code=f541e2a0275e4e991cc815bed5403f83
Submission: On July 25 via manual (July 25th 2023, 4:19:44 pm UTC) from GB — Scanned from GB

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 11 HTTP transactions. The main IP is 185.42.117.192, located in France and belongs to MAGICRETAIL, FR. The main domain is billiroksgold.cleverapps.io.
TLS certificate: Issued by R3 on May 26th 2023. Valid for: 3 months.

This is the only time billiroksgold.cleverapps.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: MitID (Government)

Domain & IP information

	IP Address	AS Autonomous System
1 1	67.199.248.11 67.199.248.11	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2 5	185.42.117.192 185.42.117.192	43424 (MAGICRETAIL) (MAGICRETAIL)
1 1	46.252.181.151 46.252.181.151	43424 (MAGICRETAIL) (MAGICRETAIL)
11	2

1 67.199.248.11 (United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: bit.ly

bit.ly	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 185.42.117.192 (France) 2 redirects

ASN43424 (MAGICRETAIL, FR)

billiroksgold.cleverapps.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 46.252.181.151 (France) 1 redirects

ASN43424 (MAGICRETAIL, FR)

billiroksgold.cleverapps.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	cleverapps.io 3 redirects billiroksgold.cleverapps.io	43 KB
1	bit.ly 1 redirects bit.ly — Cisco Umbrella Rank: 5555	292 B
0	mitid.dk Failed www.mitid.dk Failed
11	3

	Domain	Requested by
6	billiroksgold.cleverapps.io	3 redirects billiroksgold.cleverapps.io
1	bit.ly	1 redirects
0	www.mitid.dk Failed	billiroksgold.cleverapps.io
11	3

This site contains no links.

Subject Issuer	Validity	Valid
*.cleverapps.io R3	`2023-05-26` - `2023-08-24`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://billiroksgold.cleverapps.io/mit/mit/login.php?code=f541e2a0275e4e991cc815bed5403f83
Frame ID: B2BE9BFFABCD12D8182C032A227F3E90
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

MitID

Page URL History Show full URLs

https://bit.ly/Verification-MitID HTTP 301
https://billiroksgold.cleverapps.io/mit HTTP 301
http://billiroksgold.cleverapps.io/mit/ HTTP 301
https://billiroksgold.cleverapps.io/mit/ HTTP 302
https://billiroksgold.cleverapps.io/mit/mit/login.php?code=f541e2a0275e4e991cc815bed5403f83 Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

Page Statistics

11
Requests

27 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

43 kB
Transfer

301 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://bit.ly/Verification-MitID HTTP 301
https://billiroksgold.cleverapps.io/mit HTTP 301
http://billiroksgold.cleverapps.io/mit/ HTTP 301
https://billiroksgold.cleverapps.io/mit/ HTTP 302
https://billiroksgold.cleverapps.io/mit/mit/login.php?code=f541e2a0275e4e991cc815bed5403f83 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request login.php Show response billiroksgold.cleverapps.io/mit/mit/ Redirect Chain https://bit.ly/Verification-MitID https://billiroksgold.cleverapps.io/mit http://billiroksgold.cleverapps.io/mit/ https://billiroksgold.cleverapps.io/mit/ https://billiroksgold.cleverapps.io/mit/mit/login.php?code=f541e2a0275e4e991cc815bed5403f83	147 KB 19 KB	96ms 96ms	Document text/html	185.42.117.192 MAGICRETAIL
General Check archive.org Show headers Download Go to Full URL https://billiroksgold.cleverapps.io/mit/mit/login.php?code=f541e2a0275e4e991cc815bed5403f83 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 185.42.117.192 , France, ASN43424 (MAGICRETAIL, FR), Reverse DNS Software Apache / Resource Hash `4e7afa9688fad301f2fc5f491217ab86aac34912df1392394c87ec46f037056b` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36 accept-language en-GB,en;q=0.9 Response headers Content-Encoding gzip Content-Length 19221 Content-Type text/html; charset=UTF-8 Date Tue, 25 Jul 2023 16:19:40 GMT Server Apache Sozu-Id 01H66XJQ62B8YPB5DDRHC2ZF78 Vary Accept-Encoding Redirect headers Content-Length 0 Content-Type text/html; charset=UTF-8 Date Tue, 25 Jul 2023 16:19:40 GMT Location mit/login.php?code=f541e2a0275e4e991cc815bed5403f83 Server Apache Sozu-Id 01H66XJQ30RDMQS2ES78XAHMN0
GET H/1.1	200 OK	bootstrap.min.css billiroksgold.cleverapps.io/mit/mit/assets/	152 KB 23 KB	58ms 57ms	Stylesheet text/css	185.42.117.192 MAGICRETAIL
General Check archive.org Show headers Download Go to Full URL https://billiroksgold.cleverapps.io/mit/mit/assets/bootstrap.min.css Requested by Host: billiroksgold.cleverapps.io URL: https://billiroksgold.cleverapps.io/mit/mit/login.php?code=f541e2a0275e4e991cc815bed5403f83 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 185.42.117.192 , France, ASN43424 (MAGICRETAIL, FR), Reverse DNS Software Apache / Resource Hash `ae576713bc196098f7438dede6ff1f835a23291c32b745ad7e6fb6db809a719b` Request headers accept-language en-GB,en;q=0.9 Referer https://billiroksgold.cleverapps.io/mit/mit/login.php?code=f541e2a0275e4e991cc815bed5403f83 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36 Response headers Date Tue, 25 Jul 2023 16:19:40 GMT Content-Encoding gzip Last-Modified Thu, 21 Jul 2022 02:01:16 GMT Server Apache ETag "26074-5e44717c2b300-gzip" Vary Accept-Encoding Content-Type text/css Sozu-Id 01H66XJQBW8RWT7M8BM73411Z9 Accept-Ranges bytes Content-Length 23243
GET H/1.1	200 OK	site.css billiroksgold.cleverapps.io/mit/mit/assets/	1 KB 942 B	114ms 54ms	Stylesheet text/css	185.42.117.192 MAGICRETAIL
General Check archive.org Show headers Download Go to Full URL https://billiroksgold.cleverapps.io/mit/mit/assets/site.css Requested by Host: billiroksgold.cleverapps.io URL: https://billiroksgold.cleverapps.io/mit/mit/login.php?code=f541e2a0275e4e991cc815bed5403f83 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 185.42.117.192 , France, ASN43424 (MAGICRETAIL, FR), Reverse DNS Software Apache / Resource Hash `df1d21812a55eb0762be5a831438b77ea67623f203337a901cc36695d105c357` Request headers accept-language en-GB,en;q=0.9 Referer https://billiroksgold.cleverapps.io/mit/mit/login.php?code=f541e2a0275e4e991cc815bed5403f83 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36 Response headers Date Tue, 25 Jul 2023 16:19:40 GMT Content-Encoding gzip Last-Modified Thu, 21 Jul 2022 02:01:18 GMT Server Apache ETag "589-5e44717e13780-gzip" Vary Accept-Encoding Content-Type text/css Sozu-Id 01H66XJQDFXV07QP4864AQJR9M Accept-Ranges bytes Content-Length 641
GET		IBMPlexSans-Bold.woff2 www.mitid.dk/assets/fonts/	0 0

GET		IBMPlexSans-SemiBold.woff2 www.mitid.dk/assets/fonts/	0 0

GET		IBMPlexSans.woff2 www.mitid.dk/assets/fonts/	0 0

GET		IBMPlexSans-Medium.woff2 www.mitid.dk/assets/fonts/	0 0

GET		IBMPlexSans-Medium.woff www.mitid.dk/assets/fonts/	0 0

GET		IBMPlexSans-SemiBold.woff www.mitid.dk/assets/fonts/	0 0

GET		IBMPlexSans.woff www.mitid.dk/assets/fonts/	0 0

GET		IBMPlexSans-Bold.woff www.mitid.dk/assets/fonts/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.mitid.dk
URL: https://www.mitid.dk/assets/fonts/IBMPlexSans-Bold.woff2

Domain: www.mitid.dk
URL: https://www.mitid.dk/assets/fonts/IBMPlexSans-SemiBold.woff2

Domain: www.mitid.dk
URL: https://www.mitid.dk/assets/fonts/IBMPlexSans.woff2

Domain: www.mitid.dk
URL: https://www.mitid.dk/assets/fonts/IBMPlexSans-Medium.woff2

Domain: www.mitid.dk
URL: https://www.mitid.dk/assets/fonts/IBMPlexSans-Medium.woff

Domain: www.mitid.dk
URL: https://www.mitid.dk/assets/fonts/IBMPlexSans-SemiBold.woff

Domain: www.mitid.dk
URL: https://www.mitid.dk/assets/fonts/IBMPlexSans.woff

Domain: www.mitid.dk
URL: https://www.mitid.dk/assets/fonts/IBMPlexSans-Bold.woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: MitID (Government)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| validation

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.bit.ly/	1970-01-20 17:50:53	Name: _bit Value: n6pgjD-da55c876773f803b6e-00V

16 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://billiroksgold.cleverapps.io/mit/mit/login.php?code=f541e2a0275e4e991cc815bed5403f83 Message: Access to font at 'https://www.mitid.dk/assets/fonts/IBMPlexSans-Medium.woff2' from origin 'https://billiroksgold.cleverapps.io' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://www.mitid.dk/assets/fonts/IBMPlexSans-Medium.woff2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://billiroksgold.cleverapps.io/mit/mit/login.php?code=f541e2a0275e4e991cc815bed5403f83 Message: Access to font at 'https://www.mitid.dk/assets/fonts/IBMPlexSans-SemiBold.woff2' from origin 'https://billiroksgold.cleverapps.io' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://www.mitid.dk/assets/fonts/IBMPlexSans-SemiBold.woff2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://billiroksgold.cleverapps.io/mit/mit/login.php?code=f541e2a0275e4e991cc815bed5403f83 Message: Access to font at 'https://www.mitid.dk/assets/fonts/IBMPlexSans.woff2' from origin 'https://billiroksgold.cleverapps.io' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://www.mitid.dk/assets/fonts/IBMPlexSans.woff2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://billiroksgold.cleverapps.io/mit/mit/login.php?code=f541e2a0275e4e991cc815bed5403f83 Message: Access to font at 'https://www.mitid.dk/assets/fonts/IBMPlexSans-Bold.woff2' from origin 'https://billiroksgold.cleverapps.io' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://www.mitid.dk/assets/fonts/IBMPlexSans-Bold.woff2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://billiroksgold.cleverapps.io/mit/mit/login.php?code=f541e2a0275e4e991cc815bed5403f83 Message: Access to font at 'https://www.mitid.dk/assets/fonts/IBMPlexSans-SemiBold.woff' from origin 'https://billiroksgold.cleverapps.io' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://www.mitid.dk/assets/fonts/IBMPlexSans-SemiBold.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://billiroksgold.cleverapps.io/mit/mit/login.php?code=f541e2a0275e4e991cc815bed5403f83 Message: Access to font at 'https://www.mitid.dk/assets/fonts/IBMPlexSans-Medium.woff' from origin 'https://billiroksgold.cleverapps.io' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://www.mitid.dk/assets/fonts/IBMPlexSans-Medium.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://billiroksgold.cleverapps.io/mit/mit/login.php?code=f541e2a0275e4e991cc815bed5403f83 Message: Access to font at 'https://www.mitid.dk/assets/fonts/IBMPlexSans.woff' from origin 'https://billiroksgold.cleverapps.io' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://www.mitid.dk/assets/fonts/IBMPlexSans.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://billiroksgold.cleverapps.io/mit/mit/login.php?code=f541e2a0275e4e991cc815bed5403f83 Message: Access to font at 'https://www.mitid.dk/assets/fonts/IBMPlexSans-Bold.woff' from origin 'https://billiroksgold.cleverapps.io' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://www.mitid.dk/assets/fonts/IBMPlexSans-Bold.woff Message: Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

billiroksgold.cleverapps.io
bit.ly
www.mitid.dk
www.mitid.dk
185.42.117.192
46.252.181.151
67.199.248.11
4e7afa9688fad301f2fc5f491217ab86aac34912df1392394c87ec46f037056b
ae576713bc196098f7438dede6ff1f835a23291c32b745ad7e6fb6db809a719b
df1d21812a55eb0762be5a831438b77ea67623f203337a901cc36695d105c357

billiroksgold.cleverapps.io Open in urlscan Pro 185.42.117.192 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

27 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

2 IPs

2 Countries

43 kBTransfer

301 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

1 Cookies

16 Console Messages

Indicators

billiroksgold.cleverapps.io Open in urlscan Pro
185.42.117.192 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

27 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

43 kB
Transfer

301 kB
Size

1
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!