spv.kortsikkerhet.site Open in urlscan Pro
198.251.88.188 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://spv.kortsikkerhet.site/
Submission: On May 15 via api (May 15th 2024, 11:44:28 am UTC) from US — Scanned from DE

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 12 HTTP transactions. The main IP is 198.251.88.188, located in Luxembourg, Luxembourg and belongs to PONYNET, US. The main domain is spv.kortsikkerhet.site.
TLS certificate: Issued by R3 on May 15th 2024. Valid for: 3 months.

This is the only time spv.kortsikkerhet.site was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Sparebanken West (Banking)

Domain & IP information

	IP Address	AS Autonomous System
8	198.251.88.188 198.251.88.188	53667 (PONYNET) (PONYNET)
4	46.137.15.86 46.137.15.86	16509 (AMAZON-02) (AMAZON-02)
12	2

8 198.251.88.188 (Luxembourg, Luxembourg)

ASN53667 (PONYNET, US)
PTR: c4.my-control-panel.com

spv.kortsikkerhet.site	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 46.137.15.86 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-46-137-15-86.eu-west-1.compute.amazonaws.com

api-world-d8c5917b0a3d.herokuapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	kortsikkerhet.site spv.kortsikkerhet.site	203 KB
4	herokuapp.com api-world-d8c5917b0a3d.herokuapp.com	3 KB
12	2

	Domain	Requested by
8	spv.kortsikkerhet.site	spv.kortsikkerhet.site
4	api-world-d8c5917b0a3d.herokuapp.com	spv.kortsikkerhet.site
12	2

This site contains no links.

Subject Issuer	Validity	Valid
spv.kortsikkerhet.site R3	`2024-05-15` - `2024-08-13`	3 months	crt.sh
*.herokuapp.com Amazon RSA 2048 M03	`2024-03-02` - `2025-03-31`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://spv.kortsikkerhet.site/
Frame ID: D5EB614597588D53CC1B4F6E6662B1E9
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Innlogging - Sparebanken Vest

Page Statistics

12
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

206 kB
Transfer

587 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response spv.kortsikkerhet.site/	474 B 468 B	726ms 133ms	Document text/html	198.251.88.188 PONYNET
General Check archive.org Show headers Download Go to Full URL https://spv.kortsikkerhet.site/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 198.251.88.188 Luxembourg, Luxembourg, ASN53667 (PONYNET, US), Reverse DNS c4.my-control-panel.com Software LiteSpeed / Resource Hash `e3e864830ae01c66ea77376482d8048b6ba1cb21c02e12209e36ad06e80a018b` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-encoding br content-length 215 content-type text/html date Wed, 15 May 2024 11:44:22 GMT last-modified Fri, 10 May 2024 20:03:00 GMT server LiteSpeed vary Accept-Encoding
GET H2	200	index-DoH5sIGx.js Show response spv.kortsikkerhet.site/assets/	373 KB 119 KB	270ms 264ms	Script text/javascript	198.251.88.188 PONYNET
General Check archive.org Show headers Download Go to Full URL https://spv.kortsikkerhet.site/assets/index-DoH5sIGx.js Requested by Host: spv.kortsikkerhet.site URL: https://spv.kortsikkerhet.site/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 198.251.88.188 Luxembourg, Luxembourg, ASN53667 (PONYNET, US), Reverse DNS c4.my-control-panel.com Software LiteSpeed / Resource Hash `eaea1e75bf55fed038911fd694d222230a7cfb026ab18f0f235b101aa5d5cdbf` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://spv.kortsikkerhet.site/ Origin https://spv.kortsikkerhet.site Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 11:44:22 GMT content-encoding br last-modified Fri, 10 May 2024 20:03:00 GMT server LiteSpeed vary Accept-Encoding content-type text/javascript accept-ranges bytes content-length 122002
GET H2	200	index-Ni2dw7nG.css spv.kortsikkerhet.site/assets/	20 KB 4 KB	526ms 522ms	Stylesheet text/css	198.251.88.188 PONYNET
General Check archive.org Show headers Download Go to Full URL https://spv.kortsikkerhet.site/assets/index-Ni2dw7nG.css Requested by Host: spv.kortsikkerhet.site URL: https://spv.kortsikkerhet.site/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 198.251.88.188 Luxembourg, Luxembourg, ASN53667 (PONYNET, US), Reverse DNS c4.my-control-panel.com Software LiteSpeed / Resource Hash `f85a3723bc5f555106bd9d064d4171f65a34bff98368e36c5ee993da52fcedf5` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://spv.kortsikkerhet.site/ Origin https://spv.kortsikkerhet.site Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 11:44:22 GMT content-encoding br last-modified Fri, 10 May 2024 20:03:00 GMT server LiteSpeed vary Accept-Encoding content-type text/css cache-control public, max-age=604800 accept-ranges bytes content-length 4336 expires Wed, 22 May 2024 11:44:22 GMT
GET H3	200	spv-logo-BCZ1PDPz.svg spv.kortsikkerhet.site/assets/	12 KB 5 KB	130ms 130ms	Image image/svg+xml	198.251.88.188 PONYNET
General Check archive.org Show headers Download Go to Show image Full URL https://spv.kortsikkerhet.site/assets/spv-logo-BCZ1PDPz.svg Protocol H3 Security QUIC, , AES_128_GCM Server 198.251.88.188 Luxembourg, Luxembourg, ASN53667 (PONYNET, US), Reverse DNS c4.my-control-panel.com Software LiteSpeed / Resource Hash `b3323cb40f5179a0ecdacc9318f82bf310b033443ab65db42ffed10675be1b52` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://spv.kortsikkerhet.site/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 11:44:23 GMT content-encoding br last-modified Fri, 10 May 2024 20:03:00 GMT server LiteSpeed vary Accept-Encoding content-type image/svg+xml cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 4794 expires Wed, 22 May 2024 11:44:23 GMT
GET H3	200	bank-id-DeIFcszL.png spv.kortsikkerhet.site/assets/	5 KB 5 KB	129ms 129ms	Image image/png	198.251.88.188 PONYNET
General Check archive.org Show headers Download Go to Show image Full URL https://spv.kortsikkerhet.site/assets/bank-id-DeIFcszL.png Protocol H3 Security QUIC, , AES_128_GCM Server 198.251.88.188 Luxembourg, Luxembourg, ASN53667 (PONYNET, US), Reverse DNS c4.my-control-panel.com Software LiteSpeed / Resource Hash `06ad9feee3b0d3d90e7a32676874850d1853e17a8ee86c4a96434a16ebc62305` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://spv.kortsikkerhet.site/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 11:44:23 GMT last-modified Fri, 10 May 2024 20:03:00 GMT server LiteSpeed content-type image/png cache-control public, max-age=604800 accept-ranges bytes content-length 4950 expires Wed, 22 May 2024 11:44:23 GMT
GET H3	200	kod-BaabsuxC.png spv.kortsikkerhet.site/assets/	7 KB 7 KB	131ms 130ms	Image image/png	198.251.88.188 PONYNET
General Check archive.org Show headers Download Go to Show image Full URL https://spv.kortsikkerhet.site/assets/kod-BaabsuxC.png Protocol H3 Security QUIC, , AES_128_GCM Server 198.251.88.188 Luxembourg, Luxembourg, ASN53667 (PONYNET, US), Reverse DNS c4.my-control-panel.com Software LiteSpeed / Resource Hash `0501b73d5dbef8cc1b328d092ceedea42f828fec2d4efca7cd428458e242f99c` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://spv.kortsikkerhet.site/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 11:44:23 GMT last-modified Fri, 10 May 2024 20:03:00 GMT server LiteSpeed content-type image/png cache-control public, max-age=604800 accept-ranges bytes content-length 7112 expires Wed, 22 May 2024 11:44:23 GMT
GET H3	200	Tobias-Bold-DH4yldRD.ttf spv.kortsikkerhet.site/assets/	154 KB 59 KB	128ms 128ms	Font font/ttf	198.251.88.188 PONYNET
General Check archive.org Show headers Download Go to Full URL https://spv.kortsikkerhet.site/assets/Tobias-Bold-DH4yldRD.ttf Requested by Host: spv.kortsikkerhet.site URL: https://spv.kortsikkerhet.site/assets/index-Ni2dw7nG.css Protocol H3 Security QUIC, , AES_128_GCM Server 198.251.88.188 Luxembourg, Luxembourg, ASN53667 (PONYNET, US), Reverse DNS c4.my-control-panel.com Software LiteSpeed / Resource Hash `47117f612d3c21beca17d8e19bc0eb37c755bbb64d50659d00dc271ede623fcb` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://spv.kortsikkerhet.site/assets/index-Ni2dw7nG.css Origin https://spv.kortsikkerhet.site Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 11:44:23 GMT content-encoding br last-modified Fri, 10 May 2024 20:03:00 GMT server LiteSpeed vary Accept-Encoding content-type font/ttf cache-control public, max-age=604800 accept-ranges bytes content-length 60257 expires Wed, 22 May 2024 11:44:23 GMT
GET H/1.1	200 OK	/ Show response api-world-d8c5917b0a3d.herokuapp.com/socket.io/	118 B 901 B	266ms 59ms	XHR text/plain	46.137.15.86 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api-world-d8c5917b0a3d.herokuapp.com/socket.io/?EIO=4&transport=polling&t=Ozy4Lhu Requested by Host: spv.kortsikkerhet.site URL: https://spv.kortsikkerhet.site/assets/index-DoH5sIGx.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 46.137.15.86 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-46-137-15-86.eu-west-1.compute.amazonaws.com Software Cowboy / Resource Hash `8a1637922b56447848d1767295d5385ea6e5f26edc38db5bdb2e2286c2de3c08` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Accept / Referer https://spv.kortsikkerhet.site/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Wed, 15 May 2024 11:44:23 GMT Via 1.1 vegur Nel {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]} Server Cowboy Vary Origin Report-To {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1715773463&sid=812dcc77-0bd0-43b1-a5f1-b25750382959&s=%2BuZtHztTMNnuMTw8znevAeW%2BCdTowDvgn8uPqIoqxkE%3D"}]} Content-Type text/plain; charset=UTF-8 Access-Control-Allow-Origin https://spv.kortsikkerhet.site Cache-Control no-store Connection keep-alive Content-Length 118 Reporting-Endpoints heroku-nel=https://nel.heroku.com/reports?ts=1715773463&sid=812dcc77-0bd0-43b1-a5f1-b25750382959&s=%2BuZtHztTMNnuMTw8znevAeW%2BCdTowDvgn8uPqIoqxkE%3D
GET H3	200	spv.ico spv.kortsikkerhet.site/	15 KB 3 KB	297ms 297ms	Other image/x-icon	198.251.88.188 PONYNET
General Check archive.org Show headers Download Go to Full URL https://spv.kortsikkerhet.site/spv.ico Protocol H3 Security QUIC, , AES_128_GCM Server 198.251.88.188 Luxembourg, Luxembourg, ASN53667 (PONYNET, US), Reverse DNS c4.my-control-panel.com Software LiteSpeed / Resource Hash `5e55419211ec9700965d180203c6b3b5ccd07d23f7d46cf87c845ac58921a950` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://spv.kortsikkerhet.site/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 15 May 2024 11:44:23 GMT content-encoding br last-modified Fri, 10 May 2024 20:00:00 GMT server LiteSpeed vary Accept-Encoding content-type image/x-icon cache-control public, max-age=604800 accept-ranges bytes content-length 3288 expires Wed, 22 May 2024 11:44:23 GMT
POST H/1.1	200 OK	/ Show response api-world-d8c5917b0a3d.herokuapp.com/socket.io/	2 B 767 B	59ms 59ms	XHR text/html	46.137.15.86 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api-world-d8c5917b0a3d.herokuapp.com/socket.io/?EIO=4&transport=polling&t=Ozy4Lm5&sid=jybg8Xs0KSrdwQUMAAaX Requested by Host: spv.kortsikkerhet.site URL: https://spv.kortsikkerhet.site/assets/index-DoH5sIGx.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 46.137.15.86 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-46-137-15-86.eu-west-1.compute.amazonaws.com Software Cowboy / Resource Hash `2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Content-type text/plain;charset=UTF-8 Accept / Referer https://spv.kortsikkerhet.site/ sec-ch-ua-platform "Win32" Response headers Date Wed, 15 May 2024 11:44:23 GMT Via 1.1 vegur Nel {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]} Server Cowboy Vary Origin Report-To {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1715773463&sid=812dcc77-0bd0-43b1-a5f1-b25750382959&s=%2BuZtHztTMNnuMTw8znevAeW%2BCdTowDvgn8uPqIoqxkE%3D"}]} Content-Type text/html Access-Control-Allow-Origin https://spv.kortsikkerhet.site Cache-Control no-store Connection keep-alive Content-Length 2 Reporting-Endpoints heroku-nel=https://nel.heroku.com/reports?ts=1715773463&sid=812dcc77-0bd0-43b1-a5f1-b25750382959&s=%2BuZtHztTMNnuMTw8znevAeW%2BCdTowDvgn8uPqIoqxkE%3D
GET H/1.1	200 OK	/ Show response api-world-d8c5917b0a3d.herokuapp.com/socket.io/	32 B 814 B	121ms 61ms	XHR text/plain	46.137.15.86 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api-world-d8c5917b0a3d.herokuapp.com/socket.io/?EIO=4&transport=polling&t=Ozy4Lm6&sid=jybg8Xs0KSrdwQUMAAaX Requested by Host: spv.kortsikkerhet.site URL: https://spv.kortsikkerhet.site/assets/index-DoH5sIGx.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 46.137.15.86 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-46-137-15-86.eu-west-1.compute.amazonaws.com Software Cowboy / Resource Hash `1f2f989d9ead03eaafdb9bd800babd00aa0d281a963203ba18fa487e0c948962` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Accept / Referer https://spv.kortsikkerhet.site/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Wed, 15 May 2024 11:44:23 GMT Via 1.1 vegur Nel {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]} Server Cowboy Vary Origin Report-To {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1715773463&sid=812dcc77-0bd0-43b1-a5f1-b25750382959&s=%2BuZtHztTMNnuMTw8znevAeW%2BCdTowDvgn8uPqIoqxkE%3D"}]} Content-Type text/plain; charset=UTF-8 Access-Control-Allow-Origin https://spv.kortsikkerhet.site Cache-Control no-store Connection keep-alive Content-Length 32 Reporting-Endpoints heroku-nel=https://nel.heroku.com/reports?ts=1715773463&sid=812dcc77-0bd0-43b1-a5f1-b25750382959&s=%2BuZtHztTMNnuMTw8znevAeW%2BCdTowDvgn8uPqIoqxkE%3D
GET H/1.1	200 OK	/ Show response api-world-d8c5917b0a3d.herokuapp.com/socket.io/	1 B 782 B	294ms 294ms	XHR text/plain	46.137.15.86 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api-world-d8c5917b0a3d.herokuapp.com/socket.io/?EIO=4&transport=polling&t=Ozy4Lo1&sid=jybg8Xs0KSrdwQUMAAaX Requested by Host: spv.kortsikkerhet.site URL: https://spv.kortsikkerhet.site/assets/index-DoH5sIGx.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 46.137.15.86 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-46-137-15-86.eu-west-1.compute.amazonaws.com Software Cowboy / Resource Hash `e7f6c011776e8db7cd330b54174fd76f7d0216b612387a5ffcfb81e6f0919683` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Accept / Referer https://spv.kortsikkerhet.site/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Wed, 15 May 2024 11:44:23 GMT Via 1.1 vegur Nel {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]} Server Cowboy Vary Origin Report-To {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1715773463&sid=812dcc77-0bd0-43b1-a5f1-b25750382959&s=%2BuZtHztTMNnuMTw8znevAeW%2BCdTowDvgn8uPqIoqxkE%3D"}]} Content-Type text/plain; charset=UTF-8 Access-Control-Allow-Origin https://spv.kortsikkerhet.site Cache-Control no-store Connection keep-alive Content-Length 1 Reporting-Endpoints heroku-nel=https://nel.heroku.com/reports?ts=1715773463&sid=812dcc77-0bd0-43b1-a5f1-b25750382959&s=%2BuZtHztTMNnuMTw8znevAeW%2BCdTowDvgn8uPqIoqxkE%3D

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sparebanken West (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| __reactRouterVersion

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			spv.kortsikkerhet.site/	1970-01-20 20:40:32	Name: spv_session_id Value: f90f7606-eb41-4d51-a9e9-9e1382726347

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api-world-d8c5917b0a3d.herokuapp.com
spv.kortsikkerhet.site
198.251.88.188
46.137.15.86
0501b73d5dbef8cc1b328d092ceedea42f828fec2d4efca7cd428458e242f99c
06ad9feee3b0d3d90e7a32676874850d1853e17a8ee86c4a96434a16ebc62305
1f2f989d9ead03eaafdb9bd800babd00aa0d281a963203ba18fa487e0c948962
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
47117f612d3c21beca17d8e19bc0eb37c755bbb64d50659d00dc271ede623fcb
5e55419211ec9700965d180203c6b3b5ccd07d23f7d46cf87c845ac58921a950
8a1637922b56447848d1767295d5385ea6e5f26edc38db5bdb2e2286c2de3c08
b3323cb40f5179a0ecdacc9318f82bf310b033443ab65db42ffed10675be1b52
e3e864830ae01c66ea77376482d8048b6ba1cb21c02e12209e36ad06e80a018b
e7f6c011776e8db7cd330b54174fd76f7d0216b612387a5ffcfb81e6f0919683
eaea1e75bf55fed038911fd694d222230a7cfb026ab18f0f235b101aa5d5cdbf
f85a3723bc5f555106bd9d064d4171f65a34bff98368e36c5ee993da52fcedf5

spv.kortsikkerhet.site Open in urlscan Pro 198.251.88.188 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

12 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

206 kBTransfer

587 kBSize

1 Cookies

0 Outgoing links

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

1 Cookies

Indicators

spv.kortsikkerhet.site Open in urlscan Pro
198.251.88.188 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

206 kB
Transfer

587 kB
Size

1
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!