Security Scan: BankID

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/ea0142d1-8982-4ac0-b766-d17b601f0f10 Domain and IP registration (RDAP)/api/v1/rdap/ea0142d1-8982-4ac0-b766-d17b601f0f10How often this domain was scanned/api/v1/domain/stats/idporten-norge.vercel.app Scan history for this domain/api/v1/domain/history/idporten-norge.vercel.app?limit=15

This website contacted 3 IPs in 1 country across 1 domain to perform 6 HTTP transactions. The main domain is vercel.app and was registered 6 years ago.

Submitted URL: http://idporten-norge.vercel.app/page3.5.html/

Effective URL:

https://idporten-norge.vercel.app/page3.5.html/page4.html

Redirected

AI Security Verdict

High Risk

Confidence: 85%

Risk Score

Fake BankID/ID-porten flow on a free vercel.app subdomain impersonating Norway's official identity service; no form on this step, but the host and kit-style URL structure indicate phishing.

Risk Factors (5)

Brand impersonation of ID-porten/BankID on a non-official vercel.app subdomain

Deceptive hostname crafted to resemble an official Norwegian government/identity service

Kit-style multi-page URL structure with an 'Error' page title inconsistent with the displayed BankID content

IDS alerts for commonly actor-abused cloud hosting service (vercel.app)

No reputation: unranked domain, unknown subdomain creation date on shared hosting

Domain age information unavailable

Details

Page Title

BankIDother network

Scan Type

public

Domain Name Analysis

The domain 'idporten-norge.vercel.app' uses the application-focused generic top-level domain (.app) with subdomain 'idporten-norge'. The registrable portion 'vercel' spans 6 characters split between two vowels and 4 consonants. Splitting it apart reveals two words: ver, cel. Average segment length settles at 3 characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

0.54s

Total Load Time

15 KB

Total Size

Language Analysis

Primary Language

🇳🇴Norwegian

Code: no

Confidence:54%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:nb

Text Length:94 chars

Detector Agreement:100%

Language mismatch: Declared as nb but detected as no

Website Classification

Primary Category

finance banking50% confidence

Type: static

Method: ml+structural

All Detected Categories

finance banking

50%

adult content

26%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
2	64.29.17.195Aws · CLOUD	United States	AS16509Amazon.com, Inc.
2	64.29.17.67Aws · CLOUD	United States	AS16509Amazon.com, Inc.
2	216.198.79.195Aws · CLOUD	United States	AS16509Amazon.com, Inc.
6	3	-	-

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T15922B5E4A1F860527813C75D5E6B653A3F36B0B3CA4586147B9C67E09F49CEC8C529C8

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

192:6z2SRQ+ihA1A5m+LJquqeuPDs/ngKa2fe5wppS3aanSEIqZXxXkoh/hszrTKn:6z2SzlzeuP5wppS32ElXXko7sfTC

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:10256:iZ8AjEKkCYkBwkh8pwIBAICNMAWCE1bkhQIbMOs6AAMAKbooABAYAsQCCVg0NcUIIYgJQKIgAxc8AhgNiAMQC4SI+E4VACYG

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:3fffffffffffffff

Perceptual Hash:870f0f0f0f0f0f0f

Difference Hash:c000000000000000

Wavelet Hash:30f0f0f0f0f0f0f0

Color Hash:#4e1f93

Other Hashes

Crop Resistant:c000000000000000

Scan History

Scan history not available

Unable to load historical scan data

Security Scan Report: idporten-norge.vercel.app