secure-removal-device.com
Open in
urlscan Pro
68.65.123.120
Malicious Activity!
Public Scan
Effective URL: https://secure-removal-device.com/Login.php
Submission: On July 21 via automatic, source certstream-urgent
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on July 21st 2021. Valid for: a year.
This is the only time secure-removal-device.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Halifax Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 4 | 68.65.123.120 68.65.123.120 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
8 | 2 |
ASN22612 (NAMECHEAP-NET, US)
PTR: server276-1.web-hosting.com
secure-removal-device.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
secure-removal-device.com
1 redirects
secure-removal-device.com |
103 KB |
8 | 1 |
Domain | Requested by | |
---|---|---|
4 | secure-removal-device.com |
1 redirects
secure-removal-device.com
|
8 | 1 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.halifax-online.co.uk |
www.halifax.co.uk |
Subject Issuer | Validity | Valid | |
---|---|---|---|
secure-removal-device.com Sectigo RSA Domain Validation Secure Server CA |
2021-07-21 - 2022-07-21 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://secure-removal-device.com/Login.php
Frame ID: 2286CC10ACCFA93C327793DA5262D3D5
Requests: 8 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://secure-removal-device.com/
HTTP 302
https://secure-removal-device.com/Login.php Page URL
Detected technologies
LiteSpeed (Web Servers) ExpandDetected patterns
- headers server /^LiteSpeed$/i
Page Statistics
13 Outgoing links
These are links going to different origins than the main page.
Title: Cookie Policy
Search URL Search Domain Scan URL
Title: Remember my User ID
Search URL Search Domain Scan URL
Title: Forgotten your sign-in details?
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title: Register for Internet Banking
Search URL Search Domain Scan URL
Title: Go to desktop site
Search URL Search Domain Scan URL
Title: Help
Search URL Search Domain Scan URL
Title: Security
Search URL Search Domain Scan URL
Title: Contact us
Search URL Search Domain Scan URL
Title: Mobile Banking
Search URL Search Domain Scan URL
Title: Legal
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://secure-removal-device.com/
HTTP 302
https://secure-removal-device.com/Login.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
Login.php
secure-removal-device.com/ Redirect Chain
|
91 KB 12 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
base-auto-min200526.css
secure-removal-device.com/files/css/ |
87 KB 15 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.js
secure-removal-device.com/files/js/ |
266 KB 75 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Halifax-logo-1432115232.gif
secure-removal-device.com/files/img/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
padlock-secure-NGB-1432115235.gif
secure-removal-device.com/files/img/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
savings_newstyle-1593009617.png
secure-removal-device.com/files/img/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
fscs-ngb-logon-banner-V2-1459783745.png
secure-removal-device.com/files/img/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
chevron_right_white.png
secure-removal-device.com/files/img/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- secure-removal-device.com
- URL
- https://secure-removal-device.com/files/img/Halifax-logo-1432115232.gif
- Domain
- secure-removal-device.com
- URL
- https://secure-removal-device.com/files/img/padlock-secure-NGB-1432115235.gif
- Domain
- secure-removal-device.com
- URL
- https://secure-removal-device.com/files/img/savings_newstyle-1593009617.png
- Domain
- secure-removal-device.com
- URL
- https://secure-removal-device.com/files/img/fscs-ngb-logon-banner-V2-1459783745.png
- Domain
- secure-removal-device.com
- URL
- https://secure-removal-device.com/files/img/chevron_right_white.png
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Halifax Bank (Banking)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
secure-removal-device.com
secure-removal-device.com
68.65.123.120
171fbafc762abb3af24536f58265c21d0540bb174dc1de1e65fb8959addc3a79
84086bb634fc6fd223918894c6b74641811e06e84007937c5809942b7a02ddff
f1a08e104670da21abd4338136ac8bdcd388c2886e41d11ced35cb2da6b52ddb