urlscan.io logo urlscan.io
SecurityTrails logo

skatteetaten.is-a-liberal.com Open in urlscan Pro
45.149.241.148  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://skatteetaten.is-a-liberal.com/no/no/no/login/kode.php?unlock=code&appIdKey=4916acbdadd9142&country=NO
Submission: On January 14 via manual from NO — Scanned from NO
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 8 HTTP transactions. The main IP is 45.149.241.148, located in Ashburn, United States and belongs to NYBULA, US. The main domain is skatteetaten.is-a-liberal.com.
TLS certificate: Issued by R11 on January 13th 2025. Valid for: 3 months.
This is the only time skatteetaten.is-a-liberal.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BankID (Banking)

Domain & IP information

IP Address AS Autonomous System
4 45.149.241.148 401116 (NYBULA)
2 104.17.24.14 13335 (CLOUDFLAR...)
1 104.18.11.207 13335 (CLOUDFLAR...)
8 4
Apex Domain
Subdomains		 Transfer
4 is-a-liberal.com
skatteetaten.is-a-liberal.com
20 KB
2 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 225
35 KB
1 bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1255
14 KB
0 googleapis.com Failed
translate.googleapis.com Failed
8 4
Domain Requested by
4 skatteetaten.is-a-liberal.com skatteetaten.is-a-liberal.com
2 cdnjs.cloudflare.com skatteetaten.is-a-liberal.com
1 maxcdn.bootstrapcdn.com skatteetaten.is-a-liberal.com
0 translate.googleapis.com Failed skatteetaten.is-a-liberal.com
8 4

This site contains no links.

Subject Issuer Validity Valid
skatteetaten.is-a-liberal.com
R11		 2025-01-13 -
2025-04-13		 3 months crt.sh
cdnjs.cloudflare.com
WE1		 2024-11-26 -
2025-02-24		 3 months crt.sh
bootstrapcdn.com
WE1		 2024-11-18 -
2025-02-16		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://skatteetaten.is-a-liberal.com/no/no/no/login/kode.php?unlock=code&appIdKey=4916acbdadd9142&country=NO
Frame ID: 42581729D2EE7F5959562CED5746DEE8
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Skatteetaten

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)
Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

8
Requests

88 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

69 kB
Transfer

245 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request kode.php
skatteetaten.is-a-liberal.com/no/no/no/login/ 		17 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://skatteetaten.is-a-liberal.com/no/no/no/login/kode.php?unlock=code&appIdKey=4916acbdadd9142&country=NO
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.149.241.148 Ashburn, United States, ASN401116 (NYBULA, US),
Reverse DNS
Software
nginx /
Resource Hash
415392f7ca39ba479de1971fb98d2ef6bacf770ba3a19f8e618ff28940426e22
Security Headers
Name Value
X-Content-Type-Options nosniff nosniff
X-Frame-Options SAMEORIGIN SAMEORIGIN
X-Xss-Protection 1; mode=block 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua
"Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
br
content-type
text/html; charset=UTF-8
date
Tue, 14 Jan 2025 17:50:35 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
referrer-policy
same-origin same-origin
server
nginx
vary
Accept-Encoding
x-content-type-options
nosniff nosniff
x-frame-options
SAMEORIGIN SAMEORIGIN
x-permitted-cross-domain-policies
master-only master-only
x-xss-protection
1; mode=block 1; mode=block
oidc-client.min.css
skatteetaten.is-a-liberal.com/no/no/no/login/assets/ 		56 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://skatteetaten.is-a-liberal.com/no/no/no/login/assets/oidc-client.min.css
Requested by
Host: skatteetaten.is-a-liberal.com
URL: https://skatteetaten.is-a-liberal.com/no/no/no/login/kode.php?unlock=code&appIdKey=4916acbdadd9142&country=NO
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.149.241.148 Ashburn, United States, ASN401116 (NYBULA, US),
Reverse DNS
Software
nginx /
Resource Hash
990c190c7409dce422bd870d1a7ce2fcbcca732fa91ee31fa9fd0646b14ab8f3

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://skatteetaten.is-a-liberal.com/no/no/no/login/kode.php?unlock=code&appIdKey=4916acbdadd9142&country=NO
User-Agent
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua
"Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
max-age=315360000
content-encoding
br
etag
W/"6782fedc-e108"
expires
Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin
*
date
Tue, 14 Jan 2025 17:50:36 GMT
content-type
text/css
last-modified
Sat, 11 Jan 2025 23:29:32 GMT
server
nginx
vary
Accept-Encoding
translateelement.css
translate.googleapis.com/translate_static/css/ 		0
0
bankid-logo.28f35de5.svg
skatteetaten.is-a-liberal.com/no/no/no/login/assets/ 		3 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://skatteetaten.is-a-liberal.com/no/no/no/login/assets/bankid-logo.28f35de5.svg
Requested by
Host: skatteetaten.is-a-liberal.com
URL: https://skatteetaten.is-a-liberal.com/no/no/no/login/kode.php?unlock=code&appIdKey=4916acbdadd9142&country=NO
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.149.241.148 Ashburn, United States, ASN401116 (NYBULA, US),
Reverse DNS
Software
nginx /
Resource Hash
484e8282229f40d3e277f96ca4584b7d6c863f4270f5294bc52c365f5e6473fc

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://skatteetaten.is-a-liberal.com/no/no/no/login/kode.php?unlock=code&appIdKey=4916acbdadd9142&country=NO
User-Agent
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua
"Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
max-age=315360000
content-encoding
br
etag
W/"6782fedc-a0b"
expires
Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin
*
date
Tue, 14 Jan 2025 17:50:36 GMT
content-type
image/svg+xml
last-modified
Sat, 11 Jan 2025 23:29:32 GMT
server
nginx
vary
Accept-Encoding
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/1.6.1/ 		89 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/jquery/1.6.1/jquery.min.js
Requested by
Host: skatteetaten.is-a-liberal.com
URL: https://skatteetaten.is-a-liberal.com/no/no/no/login/kode.php?unlock=code&appIdKey=4916acbdadd9142&country=NO
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c784376960f3163dc760bc019e72e5fed78203745a5510c69992a39d1d8fe776
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua
"Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cf-cdnjs-via
cfworker/kv
content-encoding
br
cf-cache-status
HIT
etag
"5eb03ec4-164ce"
age
4159536
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QyCbazeKMQ7Erp9LgkyaFjFx019P0GctlEVcKW6x0GHRn1AzklaIXqO%2BWfa31YExZjnbEcy6g05hhv4WpKSFkvIRHWhJOyx9U0xBg2c%2BrVhOHQwU6gb%2FJu1t5ekVwtu49E50atJl"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Sun, 04 Jan 2026 17:50:36 GMT
alt-svc
h3=":443"; ma=86400
date
Tue, 14 Jan 2025 17:50:36 GMT
content-type
application/javascript; charset=utf-8
last-modified
Mon, 04 May 2020 16:11:48 GMT
vary
Accept-Encoding
strict-transport-security
max-age=15780000
cache-control
public, max-age=30672000
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
901f78273b96b527-OSL
accept-ranges
bytes
access-control-allow-origin
*
content-length
28293
server
cloudflare
jquery.validate.min.js
cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.16.0/ 		23 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.16.0/jquery.validate.min.js
Requested by
Host: skatteetaten.is-a-liberal.com
URL: https://skatteetaten.is-a-liberal.com/no/no/no/login/kode.php?unlock=code&appIdKey=4916acbdadd9142&country=NO
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
50e497b00818378dcffe856b994f89947b620c66163768879c9b8a63d583f898
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua
"Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cf-cdnjs-via
cfworker/kv
content-encoding
br
cf-cache-status
HIT
etag
"5eb03ec2-5a1e"
age
66609
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O8qaKkZDaRW6vL%2FSvjp9V6ZCIJO6FYioVSG%2BcVmQi3t60dFEEuY%2BzrKBOI%2B7qEGPZ0troFEV0NF6mzXTVkZjjDvFP1BTcD%2B1x7e%2Bqu5uKt0aZ9LK1F154G0RgtF%2BnBsGbrwlPaS1"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Sun, 04 Jan 2026 17:50:36 GMT
alt-svc
h3=":443"; ma=86400
date
Tue, 14 Jan 2025 17:50:36 GMT
content-type
application/javascript; charset=utf-8
last-modified
Mon, 04 May 2020 16:11:46 GMT
vary
Accept-Encoding
strict-transport-security
max-age=15780000
cache-control
public, max-age=30672000
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
901f78273b99b527-OSL
accept-ranges
bytes
access-control-allow-origin
*
content-length
6638
server
cloudflare
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/ 		48 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Requested by
Host: skatteetaten.is-a-liberal.com
URL: https://skatteetaten.is-a-liberal.com/no/no/no/login/kode.php?unlock=code&appIdKey=4916acbdadd9142&country=NO
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.11.207 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua
"Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cdn-status
200
content-encoding
br
cf-cache-status
HIT
etag
"14d449eb8876fa55e1ef3c2cc52b0c17"
age
2390014
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
date
Tue, 14 Jan 2025 17:50:36 GMT
last-modified
Mon, 25 Jan 2021 22:04:04 GMT
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
cdn-cache
HIT
cdn-cachedat
11/20/2024 14:11:37
cdn-requestpullcode
200
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=31919000
cdn-requestpullsuccess
True
timing-allow-origin
*
cdn-requesttime
0
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
22ee951d058bdbb194846a7e3e968d83
cross-origin-resource-policy
cross-origin
cdn-pullzone
252412
cdn-proxyver
1.06
cf-ray
901f7827ac38b515-OSL
access-control-allow-origin
*
cdn-edgestorageid
1002
server
cloudflare
cdn-requestcountrycode
US
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2fbbbda646f6c6004b2f3670d40a1ad4d5df6c8a0089943845aa5fe55a749e92

Request headers

User-Agent
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
truncated
/ 		997 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
05963eb01688d9d70b3580fa1be7b11d99a66087656a2b6af1d80bd9670ef1e6

Request headers

User-Agent
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
truncated
/ 		167 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
cbee76f080a3f8638f8d1cc0e1457adf5588a5ca44b56c5bf719bb5f57f0f2de

Request headers

User-Agent
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
truncated
/ 		760 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7f766030e9de9c68acdacfc671963f8cd00ba8783fc9c25e1d3f3319ebbecbd1

Request headers

User-Agent
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
truncated
/ 		366 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1129010d99dbbadc009c2fe07a56d8e634df144a854a328f36a30e0a5344b5b6

Request headers

User-Agent
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
truncated
/ 		172 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4dca530d4682ddf6f4b9053173c007f95875c2634a6b61c9573d93fc21483766

Request headers

User-Agent
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
truncated
/ 		296 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
296d8f67dcf848a35385d138a46404f00c21f1a8eb22249473ddd9aab1f411ab

Request headers

User-Agent
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
truncated
/ 		240 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
254868d92f9456d518064051d29f9ff0532bf9a5da291b06f8accb0900e40072

Request headers

User-Agent
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
truncated
/ 		494 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e356f94cb14b1e3c53975eb33c18f36f0c9dd1b4866940d6e243d2063546fa30

Request headers

User-Agent
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
favicon.b4be5517.png
skatteetaten.is-a-liberal.com/no/no/no/login/assets/ 		4 KB
4 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://skatteetaten.is-a-liberal.com/no/no/no/login/assets/favicon.b4be5517.png
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.149.241.148 Ashburn, United States, ASN401116 (NYBULA, US),
Reverse DNS
Software
nginx /
Resource Hash
09279bbfd669e9974f4ff8c987417665eb32a3377a6a39182e87eda820554544

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://skatteetaten.is-a-liberal.com/no/no/no/login/kode.php?unlock=code&appIdKey=4916acbdadd9142&country=NO
User-Agent
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.88 Mobile Safari/537.36
sec-ch-ua
"Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
max-age=315360000
content-encoding
br
etag
W/"6782fedc-117b"
expires
Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin
*
date
Tue, 14 Jan 2025 17:50:36 GMT
content-type
image/png
last-modified
Sat, 11 Jan 2025 23:29:32 GMT
server
nginx
vary
Accept-Encoding

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
translate.googleapis.com
URL
https://translate.googleapis.com/translate_static/css/translateelement.css

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BankID (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery object| bootstrap

1 Cookies

Domain/Path Name / Value
skatteetaten.is-a-liberal.com/ Name: PHPSESSID
Value: msk6kvqar9f6h0ggjeik3tn9vk

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff nosniff
X-Frame-Options SAMEORIGIN SAMEORIGIN
X-Xss-Protection 1; mode=block 1; mode=block