urlscan.io logo urlscan.io
SecurityTrails logo

tthedayhascometoanend.xyz Open in urlscan Pro
45.89.66.110  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://tthedayhascometoanend.xyz/Saturday/handelsbanken/validation/
Submission: On August 30 via api from QA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 3 countries across 2 domains to perform 7 HTTP transactions. The main IP is 45.89.66.110, located in Russian Federation and belongs to IHOR-AS, RU. The main domain is tthedayhascometoanend.xyz.
TLS certificate: Issued by cPanel, Inc. Certification Authority on August 27th 2020. Valid for: 3 months.
This is the only time tthedayhascometoanend.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Handelsbanken (Banking)

Domain & IP information

IP Address AS Autonomous System
1 5 45.89.66.110 35196 (IHOR-AS)
1 192.176.124.131 3301 (TELIANET-...)
1 194.240.69.206 28883 (SAMLINK-AS)
7 4
Apex Domain
Subdomains		 Transfer
5 tthedayhascometoanend.xyz
tthedayhascometoanend.xyz
719 KB
2 handelsbanken.fi
www4.handelsbanken.fi Failed
www.handelsbanken.fi
644 KB
7 2
Domain Requested by
5 tthedayhascometoanend.xyz 1 redirects tthedayhascometoanend.xyz
1 www.handelsbanken.fi tthedayhascometoanend.xyz
1 www4.handelsbanken.fi tthedayhascometoanend.xyz
7 3

This site contains no links.

Subject Issuer Validity Valid
tthedayhascometoanend.xyz
cPanel, Inc. Certification Authority		 2020-08-27 -
2020-11-25		 3 months crt.sh
www.handelsbanken.se
DigiCert SHA2 Extended Validation Server CA		 2020-03-13 -
2021-03-18		 a year crt.sh
www4.handelsbanken.fi
DigiCert SHA2 Extended Validation Server CA		 2020-01-30 -
2021-02-03		 a year crt.sh

This page contains 1 frames:

Primary Page: https://tthedayhascometoanend.xyz/Saturday/handelsbanken/validation/
Frame ID: B0A5F7C0403A4A35834B8BB765FDFC1A
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://tthedayhascometoanend.xyz/Saturday/handelsbanken/validation HTTP 301
    https://tthedayhascometoanend.xyz/Saturday/handelsbanken/validation/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

7
Requests

86 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

4
IPs

3
Countries

1363 kB
Transfer

1367 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://tthedayhascometoanend.xyz/Saturday/handelsbanken/validation HTTP 301
    https://tthedayhascometoanend.xyz/Saturday/handelsbanken/validation/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://www4.handelsbanken.fi/pankki/assets20200607134119604/shb/css/shb_private.min.css HTTP 302
  • https://www4.handelsbanken.fi/pankki/kirjautuminen HTTP 302
  • https://www4.handelsbanken.fi/pankki/kirjautuminen?0 HTTP 302
  • https://www4.handelsbanken.fi/pankki/kirjautuminen HTTP 302
  • https://www4.handelsbanken.fi/pankki/kirjautuminen?0 HTTP 302
  • https://www4.handelsbanken.fi/pankki/kirjautuminen HTTP 302
  • https://www4.handelsbanken.fi/pankki/kirjautuminen?0 HTTP 302
  • https://www4.handelsbanken.fi/pankki/kirjautuminen HTTP 302
  • https://www4.handelsbanken.fi/pankki/kirjautuminen?0 HTTP 302
  • https://www4.handelsbanken.fi/pankki/kirjautuminen HTTP 302
  • https://www4.handelsbanken.fi/pankki/kirjautuminen?0 HTTP 302
  • https://www4.handelsbanken.fi/pankki/kirjautuminen HTTP 302
  • https://www4.handelsbanken.fi/pankki/kirjautuminen?0 HTTP 302
  • https://www4.handelsbanken.fi/pankki/kirjautuminen HTTP 302
  • https://www4.handelsbanken.fi/pankki/kirjautuminen?0 HTTP 302
  • https://www4.handelsbanken.fi/pankki/kirjautuminen HTTP 302
  • https://www4.handelsbanken.fi/pankki/kirjautuminen?0 HTTP 302
  • https://www4.handelsbanken.fi/pankki/kirjautuminen HTTP 302
  • https://www4.handelsbanken.fi/pankki/kirjautuminen?0 HTTP 302
  • https://www4.handelsbanken.fi/pankki/kirjautuminen HTTP 302
  • https://www4.handelsbanken.fi/pankki/kirjautuminen?0

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
tthedayhascometoanend.xyz/Saturday/handelsbanken/validation/
Redirect Chain
  • https://tthedayhascometoanend.xyz/Saturday/handelsbanken/validation
  • https://tthedayhascometoanend.xyz/Saturday/handelsbanken/validation/
269 KB
269 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tthedayhascometoanend.xyz/Saturday/handelsbanken/validation/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
45.89.66.110 , Russian Federation, ASN35196 (IHOR-AS, RU),
Reverse DNS
Software
Apache /
Resource Hash
ada32374af61fcb53912c32935675bcf6e935f809caebb00833362c9df6c25f3

Request headers

Host
tthedayhascometoanend.xyz
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sun, 30 Aug 2020 01:34:04 GMT
Server
Apache
Keep-Alive
timeout=5, max=99
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8

Redirect headers

Date
Sun, 30 Aug 2020 01:34:03 GMT
Server
Apache
Location
https://tthedayhascometoanend.xyz/Saturday/handelsbanken/validation/
Content-Length
276
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html; charset=iso-8859-1
kirjautuminen
www4.handelsbanken.fi/pankki/
Redirect Chain
  • https://www4.handelsbanken.fi/pankki/assets20200607134119604/shb/css/shb_private.min.css
  • https://www4.handelsbanken.fi/pankki/kirjautuminen
  • https://www4.handelsbanken.fi/pankki/kirjautuminen?0
  • https://www4.handelsbanken.fi/pankki/kirjautuminen
  • https://www4.handelsbanken.fi/pankki/kirjautuminen?0
  • https://www4.handelsbanken.fi/pankki/kirjautuminen
  • https://www4.handelsbanken.fi/pankki/kirjautuminen?0
  • https://www4.handelsbanken.fi/pankki/kirjautuminen
  • https://www4.handelsbanken.fi/pankki/kirjautuminen?0
  • https://www4.handelsbanken.fi/pankki/kirjautuminen
  • https://www4.handelsbanken.fi/pankki/kirjautuminen?0
  • https://www4.handelsbanken.fi/pankki/kirjautuminen
  • https://www4.handelsbanken.fi/pankki/kirjautuminen?0
  • https://www4.handelsbanken.fi/pankki/kirjautuminen
  • https://www4.handelsbanken.fi/pankki/kirjautuminen?0
  • https://www4.handelsbanken.fi/pankki/kirjautuminen
  • https://www4.handelsbanken.fi/pankki/kirjautuminen?0
  • https://www4.handelsbanken.fi/pankki/kirjautuminen
  • https://www4.handelsbanken.fi/pankki/kirjautuminen?0
  • https://www4.handelsbanken.fi/pankki/kirjautuminen
  • https://www4.handelsbanken.fi/pankki/kirjautuminen?0
0
0
shb-large-logo.svg
www.handelsbanken.fi/sv/sepu/img/jedi/base/kit/ 		13 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.handelsbanken.fi/sv/sepu/img/jedi/base/kit/shb-large-logo.svg
Requested by
Host: tthedayhascometoanend.xyz
URL: https://tthedayhascometoanend.xyz/Saturday/handelsbanken/validation/
Protocol
HTTP/1.1
Security
TLS 1.3, , CHACHA20_POLY1305
Server
192.176.124.131 , Sweden, ASN3301 (TELIANET-SWEDEN Telia Company, SE),
Reverse DNS
link01.handelsbanken.se
Software
/
Resource Hash
0c190b7ac47351e097e26239bac09899f1980464bf6499d0389084d7f390dc72
Security Headers
Name Value
Content-Security-Policy default-src 'none'; script-src 'self'; img-src 'self' https://www.google-analytics.com:443 https://*.qbrick.com:443 https://*.dna.ip-only.net https://bilder.hemnet.se:443 https://mb.cision.com; media-src 'self' https://*.qbrick.com:443 https://*.dna.ip-only.net; connect-src 'self' https://*.qbrick.com:443; style-src 'self' 'unsafe-inline'; frame-src *.handelsbanken.se *.handelsbanken.fi *.handelsbanken.no *.handelsbanken.dk *.handelsbanken.co.uk *.handelsbanken.pl *.handelsbanken.de r1.surveysandforms.com secure.msse.se www.efn.se clients.maptoweb.dk borsrum.episerverhosting.com shbfxcalc.millistream.com www.anpdm.com services.cicero.no nettbank.edb.com shbdk.millistream.com cphspk01.shbmain.shb.biz www.shb.dk priolaan.dk weblaan.shb.bec.dk web37.prod.bec.dk netbank.shb.dk irs.tools.investis.com otp.tools.investis.com vp292.alertir.com forms.apsisforms.com handelsbanken.easycruit.com handelsbankendk.easycruit.com video.qbrick.com dreambroker.com handelsbanken.dreambroker.com; font-src 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://tthedayhascometoanend.xyz/Saturday/handelsbanken/validation/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sun, 30 Aug 2020 01:30:54 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Age
190
Connection
keep-alive
Vary
Accept-Encoding
Content-Length
4816
X-XSS-Protection
1; mode=block
Last-Modified
Thu, 20 Aug 2020 06:38:34 GMT
X-Frame-Options
DENY
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
Cache-Control
public
Content-Security-Policy
default-src 'none'; script-src 'self'; img-src 'self' https://www.google-analytics.com:443 https://*.qbrick.com:443 https://*.dna.ip-only.net https://bilder.hemnet.se:443 https://mb.cision.com; media-src 'self' https://*.qbrick.com:443 https://*.dna.ip-only.net; connect-src 'self' https://*.qbrick.com:443; style-src 'self' 'unsafe-inline'; frame-src *.handelsbanken.se *.handelsbanken.fi *.handelsbanken.no *.handelsbanken.dk *.handelsbanken.co.uk *.handelsbanken.pl *.handelsbanken.de r1.surveysandforms.com secure.msse.se www.efn.se clients.maptoweb.dk borsrum.episerverhosting.com shbfxcalc.millistream.com www.anpdm.com services.cicero.no nettbank.edb.com shbdk.millistream.com cphspk01.shbmain.shb.biz www.shb.dk priolaan.dk weblaan.shb.bec.dk web37.prod.bec.dk netbank.shb.dk irs.tools.investis.com otp.tools.investis.com vp292.alertir.com forms.apsisforms.com handelsbanken.easycruit.com handelsbankendk.easycruit.com video.qbrick.com dreambroker.com handelsbanken.dreambroker.com; font-src 'self'
Accept-Ranges
bytes
Expires
Tue, 29 Sep 2020 01:30:54 GMT
keycard-image.png
tthedayhascometoanend.xyz/Saturday/handelsbanken/validation/ 		450 KB
450 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tthedayhascometoanend.xyz/Saturday/handelsbanken/validation/keycard-image.png
Requested by
Host: tthedayhascometoanend.xyz
URL: https://tthedayhascometoanend.xyz/Saturday/handelsbanken/validation/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
45.89.66.110 , Russian Federation, ASN35196 (IHOR-AS, RU),
Reverse DNS
Software
Apache /
Resource Hash
6f1497ada6130f0621c0be65d76d578c5a85b1a72af6e1e8bd4cb93efab8d7ee

Request headers

Referer
https://tthedayhascometoanend.xyz/Saturday/handelsbanken/validation/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sun, 30 Aug 2020 01:34:04 GMT
Last-Modified
Mon, 11 Nov 2019 03:03:00 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
460396
image
www4.handelsbanken.fi/pankki/cms/ 		636 KB
638 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www4.handelsbanken.fi/pankki/cms/image?uuid=7763c9d2-c9b4-4b92-a8d6-2f4bfc3c9a70&groupId=18028&t=1542966729457
Requested by
Host: tthedayhascometoanend.xyz
URL: https://tthedayhascometoanend.xyz/Saturday/handelsbanken/validation/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
194.240.69.206 , Finland, ASN28883 (SAMLINK-AS, FI),
Reverse DNS
www4.handelsbanken.fi
Software
/
Resource Hash
40597200640275a330720b90f639444969ef235df7aa8076c8a6bea9f3531ed4
Security Headers
Name Value
Content-Security-Policy frame-src https://idpsecure.handelsbanken.fi https://www1.handelsbanken.fi;default-src 'none';connect-src 'self';font-src 'self';img-src 'self' data:;style-src 'self' 'unsafe-inline';script-src https://secure.handelsbanken.com 'self' 'unsafe-inline' 'unsafe-eval'; object-src 'self'
Strict-Transport-Security max-age=31536000;
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://tthedayhascometoanend.xyz/Saturday/handelsbanken/validation/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sun, 30 Aug 2020 01:34:04 GMT
X-Content-Type-Options
nosniff
X-Frame-Options
DENY
Connection
Keep-Alive
Content-Type
image/png
Cache-Control
max-age=7200, public
Transfer-Encoding
chunked
Content-Security-Policy
frame-src https://idpsecure.handelsbanken.fi https://www1.handelsbanken.fi;default-src 'none';connect-src 'self';font-src 'self';img-src 'self' data:;style-src 'self' 'unsafe-inline';script-src https://secure.handelsbanken.com 'self' 'unsafe-inline' 'unsafe-eval'; object-src 'self'
Strict-Transport-Security
max-age=31536000;
Keep-Alive
timeout=15, max=100
X-XSS-Protection
1; mode=block
StagWeb-Medium.woff
tthedayhascometoanend.xyz/Saturday/netbank/font/stagweb/ 		0
0 		Font
General
Check archive.org
Download Go to
Full URL
https://tthedayhascometoanend.xyz/Saturday/netbank/font/stagweb/StagWeb-Medium.woff
Requested by
Host: tthedayhascometoanend.xyz
URL: https://tthedayhascometoanend.xyz/Saturday/handelsbanken/validation/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
45.89.66.110 , Russian Federation, ASN35196 (IHOR-AS, RU),
Reverse DNS
Software
Apache /
Resource Hash

Request headers

Origin
https://tthedayhascometoanend.xyz
Referer
https://tthedayhascometoanend.xyz/Saturday/handelsbanken/validation/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sun, 30 Aug 2020 01:34:04 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=97
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
StagWeb-Medium.ttf
tthedayhascometoanend.xyz/Saturday/netbank/font/stagweb/ 		0
0 		Font
General
Check archive.org
Download Go to
Full URL
https://tthedayhascometoanend.xyz/Saturday/netbank/font/stagweb/StagWeb-Medium.ttf
Requested by
Host: tthedayhascometoanend.xyz
URL: https://tthedayhascometoanend.xyz/Saturday/handelsbanken/validation/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
45.89.66.110 , Russian Federation, ASN35196 (IHOR-AS, RU),
Reverse DNS
Software
Apache /
Resource Hash

Request headers

Origin
https://tthedayhascometoanend.xyz
Referer
https://tthedayhascometoanend.xyz/Saturday/handelsbanken/validation/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sun, 30 Aug 2020 01:34:04 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=96
Content-Length
315
Content-Type
text/html; charset=iso-8859-1

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
www4.handelsbanken.fi
URL
https://www4.handelsbanken.fi/pankki/kirjautuminen?0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Handelsbanken (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes

0 Cookies