www.ref0927-santan.co.uk
Open in
urlscan Pro
176.123.0.55
Malicious Activity!
Public Scan
Effective URL: https://www.ref0927-santan.co.uk//pages
Submission: On September 06 via manual from GB — Scanned from GB
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on August 31st 2022. Valid for: 3 months.
This is the only time www.ref0927-santan.co.uk was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Santander (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 7 | 176.123.0.55 176.123.0.55 | 200019 (ALEXHOST) (ALEXHOST) | |
1 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:2a | 20446 (STACKPATH...) (STACKPATH-CDN) | |
2 | 185.126.226.146 185.126.226.146 | 9009 (M247) (M247) | |
3 | 193.127.210.129 193.127.210.129 | 2134 (GSVNET-AS...) (GSVNET-AS GS Virtual Network Produban) | |
1 | 52.54.147.140 52.54.147.140 | 14618 (AMAZON-AES) (AMAZON-AES) | |
26 | 6 |
ASN200019 (ALEXHOST, MD)
PTR: hosting2.alexhost.md
www.ref0927-santan.co.uk |
ASN2134 (GSVNET-AS GS Virtual Network Produban, ES)
retail.santander.co.uk |
ASN14618 (AMAZON-AES, US)
PTR: ec2-52-54-147-140.compute-1.amazonaws.com
events.splash-screen.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
ref0927-santan.co.uk
1 redirects
www.ref0927-santan.co.uk |
68 KB |
3 |
santander.co.uk
retail.santander.co.uk — Cisco Umbrella Rank: 96917 |
119 KB |
2 |
onlinewebfonts.com
db.onlinewebfonts.com — Cisco Umbrella Rank: 64691 |
1 KB |
1 |
splash-screen.net
events.splash-screen.net — Cisco Umbrella Rank: 121998 |
103 B |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 976 |
30 KB |
26 | 5 |
Domain | Requested by | |
---|---|---|
7 | www.ref0927-santan.co.uk |
1 redirects
www.ref0927-santan.co.uk
|
3 | retail.santander.co.uk |
www.ref0927-santan.co.uk
|
2 | db.onlinewebfonts.com |
www.ref0927-santan.co.uk
db.onlinewebfonts.com |
1 | events.splash-screen.net |
www.ref0927-santan.co.uk
|
1 | code.jquery.com |
www.ref0927-santan.co.uk
|
26 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
ref0927-santan.co.uk cPanel, Inc. Certification Authority |
2022-08-31 - 2022-11-29 |
3 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2022-08-03 - 2023-07-14 |
a year | crt.sh |
onlinewebfonts.com Sectigo RSA Domain Validation Secure Server CA |
2021-11-05 - 2022-12-05 |
a year | crt.sh |
retail.santander.co.uk Entrust Certification Authority - L1M |
2022-03-08 - 2023-04-04 |
a year | crt.sh |
*.splash-screen.net DigiCert TLS RSA SHA256 2020 CA1 |
2022-01-26 - 2023-02-26 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.ref0927-santan.co.uk//pages
Frame ID: CA66223AF2581E7E7203CC06EE1E57A3
Requests: 26 HTTP requests in this frame
Screenshot
Page Title
Personal Online Banking: Log on or sign upBack ButtonSearch IconFilter IconArrowPage URL History Show full URLs
-
http://www.ref0927-santan.co.uk/
HTTP 302
https://www.ref0927-santan.co.uk//pages Page URL
Detected technologies
jQuery (JavaScript Libraries) ExpandDetected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://www.ref0927-santan.co.uk/
HTTP 302
https://www.ref0927-santan.co.uk//pages Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
26 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
pages
www.ref0927-santan.co.uk// Redirect Chain
|
151 KB 28 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.1.1.min.js
code.jquery.com/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
058d42bfae0ddfbe480af070188ce3e8
db.onlinewebfonts.com/c/ |
1 KB 684 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dbe98f282aedd7682f9e1fac27daa2e1
db.onlinewebfonts.com/c/ |
1 KB 678 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.js
www.ref0927-santan.co.uk//js/cntdjs/ |
87 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.mask.js
www.ref0927-santan.co.uk//js/cntdjs/ |
23 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cntd.js
www.ref0927-santan.co.uk//js/cntdjs/ |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loading.js
www.ref0927-santan.co.uk//js/shared/ |
2 KB 1013 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
online_status.js
www.ref0927-santan.co.uk//js/shared/ |
998 B 739 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styles.4ecb1b09ca667fa7af2f.css
retail.santander.co.uk/olb/app/logon/access/ |
181 KB 38 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
header-logo.png
retail.santander.co.uk/olb/app/logon/access/assets/images/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
asset-3-3-x@2x.png
retail.santander.co.uk/olb/app/logon/access/assets/images/ |
77 KB 78 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
events.splash-screen.net/splash_events/ |
0 103 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
058d42bfae0ddfbe480af070188ce3e8.woff2
db.onlinewebfonts.com/t/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
058d42bfae0ddfbe480af070188ce3e8.woff
db.onlinewebfonts.com/t/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
058d42bfae0ddfbe480af070188ce3e8.ttf
db.onlinewebfonts.com/t/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
dbe98f282aedd7682f9e1fac27daa2e1.woff2
db.onlinewebfonts.com/t/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
dbe98f282aedd7682f9e1fac27daa2e1.woff
db.onlinewebfonts.com/t/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
dbe98f282aedd7682f9e1fac27daa2e1.ttf
db.onlinewebfonts.com/t/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
058d42bfae0ddfbe480af070188ce3e8.woff2
db.onlinewebfonts.com/t/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
058d42bfae0ddfbe480af070188ce3e8.woff
db.onlinewebfonts.com/t/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
058d42bfae0ddfbe480af070188ce3e8.ttf
db.onlinewebfonts.com/t/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
dbe98f282aedd7682f9e1fac27daa2e1.woff2
db.onlinewebfonts.com/t/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
dbe98f282aedd7682f9e1fac27daa2e1.woff
db.onlinewebfonts.com/t/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
dbe98f282aedd7682f9e1fac27daa2e1.ttf
db.onlinewebfonts.com/t/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
dbe98f282aedd7682f9e1fac27daa2e1.woff2
db.onlinewebfonts.com/t/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- db.onlinewebfonts.com
- URL
- http://db.onlinewebfonts.com/t/058d42bfae0ddfbe480af070188ce3e8.woff2
- Domain
- db.onlinewebfonts.com
- URL
- http://db.onlinewebfonts.com/t/058d42bfae0ddfbe480af070188ce3e8.woff
- Domain
- db.onlinewebfonts.com
- URL
- http://db.onlinewebfonts.com/t/058d42bfae0ddfbe480af070188ce3e8.ttf
- Domain
- db.onlinewebfonts.com
- URL
- http://db.onlinewebfonts.com/t/dbe98f282aedd7682f9e1fac27daa2e1.woff2
- Domain
- db.onlinewebfonts.com
- URL
- http://db.onlinewebfonts.com/t/dbe98f282aedd7682f9e1fac27daa2e1.woff
- Domain
- db.onlinewebfonts.com
- URL
- http://db.onlinewebfonts.com/t/dbe98f282aedd7682f9e1fac27daa2e1.ttf
- Domain
- db.onlinewebfonts.com
- URL
- http://db.onlinewebfonts.com/t/058d42bfae0ddfbe480af070188ce3e8.woff2
- Domain
- db.onlinewebfonts.com
- URL
- http://db.onlinewebfonts.com/t/058d42bfae0ddfbe480af070188ce3e8.woff
- Domain
- db.onlinewebfonts.com
- URL
- http://db.onlinewebfonts.com/t/058d42bfae0ddfbe480af070188ce3e8.ttf
- Domain
- db.onlinewebfonts.com
- URL
- http://db.onlinewebfonts.com/t/dbe98f282aedd7682f9e1fac27daa2e1.woff2
- Domain
- db.onlinewebfonts.com
- URL
- http://db.onlinewebfonts.com/t/dbe98f282aedd7682f9e1fac27daa2e1.woff
- Domain
- db.onlinewebfonts.com
- URL
- http://db.onlinewebfonts.com/t/dbe98f282aedd7682f9e1fac27daa2e1.ttf
- Domain
- db.onlinewebfonts.com
- URL
- https://db.onlinewebfonts.com/t/dbe98f282aedd7682f9e1fac27daa2e1.woff2
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Santander (Banking)19 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery string| urlroot string| uniqueid object| submitButton boolean| can_proceed_pid boolean| can_proceed_snum object| controller string| url1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.ref0927-santan.co.uk/ | Name: PHPSESSID Value: d122db79acb2512675ca3acd3461886e |
13 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
db.onlinewebfonts.com
events.splash-screen.net
retail.santander.co.uk
www.ref0927-santan.co.uk
db.onlinewebfonts.com
176.123.0.55
185.126.226.146
193.127.210.129
2001:4de0:ac18::1:a:2a
52.54.147.140
044006c8d9a82a8a53990c6c992d9e38780d3217055d042243a7929fd73a1a1c
08f86c6496d80636195dd2e2037f5c141f65ed6b969514531e61512ea239c5d8
12a236397be6a4311581dd121693638bb0db72c1066118605a73a93318089ca1
1324dc9f42a55aba7440eec2db249a67e9ba03a5256f2351d8fe7f0b9e707727
4bdc871a71df801aa86926434d6fbed9744ec4757af4e9d6d40978724ea59134
5b056148977cddad1d04190e8588f71549f5fbce2c8504fd0a52699a451896ca
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
971364b4555ac4a877948da0f81d66421b8b2c974dfaf349fb20e0ab9f2d44c9
a199620fe981df00a825f78761d3f7c8870f8117daa4a890e08018dec386dae8
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e64e9d464beb9fe2717cd8bd8d093bb04d570f08a15c65f14533733904e12be7
f700c3638638b62b07e614c8cae5665cf4bfa956452ab4e6fea5a15965fc40f7
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e