www.consul.kz Open in urlscan Pro
82.200.247.240 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://www.consul.kz/templates/system/images/account/ib.nab.html
Submission: On July 26 via manual (July 26th 2017, 11:48:13 pm UTC) from AU

Summary HTTP 28 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 3 domains to perform 28 HTTP transactions. The main IP is 82.200.247.240, located in Kazakhstan and belongs to KAZTELECOM-AS, KZ. The main domain is www.consul.kz.

This is the only time www.consul.kz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: NAB Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	82.200.247.240 82.200.247.240	9198 (KAZTELECO...) (KAZTELECOM-AS)
20	23.43.30.163 23.43.30.163	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1	45.33.109.129 45.33.109.129	63949 (LINODE-AP...) (LINODE-AP Linode)
1	104.108.49.155 104.108.49.155	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
28	5

1 82.200.247.240 (Kazakhstan)

ASN9198 (KAZTELECOM-AS, KZ)

www.consul.kz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 23.43.30.163 (Amsterdam, Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a23-43-30-163.deploy.static.akamaitechnologies.com

ib.nab.com.au	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 45.33.109.129 (Fremont, United States)

ASN63949 (LINODE-AP Linode, LLC, US)
PTR: li1436-129.members.linode.com

www.clker.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.108.49.155 (Amsterdam, Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-108-49-155.deploy.static.akamaitechnologies.com

www.nab.com.au	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
21	nab.com.au ib.nab.com.au www.nab.com.au	41 KB
1	clker.com www.clker.com	6 KB
1	consul.kz www.consul.kz	19 KB
28	3

	Domain	Requested by
20	ib.nab.com.au	www.consul.kz
1	www.nab.com.au	www.consul.kz
1	www.clker.com	www.consul.kz
1	www.consul.kz
28	4

This site contains links to these domains. Also see Links.

Domain
www.nab.com.au

Subject Issuer	Validity	Valid
ib.nab.com.au Symantec Class 3 EV SSL CA - G3	`2016-11-29` - `2018-01-24`	a year	crt.sh
www.nab.com.au Symantec Class 3 EV SSL CA - G3	`2016-02-03` - `2018-02-02`	2 years	crt.sh

This page contains 2 frames:

Primary Page: http://www.consul.kz/templates/system/images/account/ib.nab.html
Frame ID: 28760.1
Requests: 27 HTTP requests in this frame

Frame: https://www.nab.com.au/static/IB/loginBanner/
Frame ID: 28760.2
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

28
Requests

75 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

5
IPs

3
Countries

67 kB
Transfer

104 kB
Size

31
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: http://www.nab.com.au/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

28 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request ib.nab.html Show response www.consul.kz/templates/system/images/account/	19 KB 19 KB	222ms 111ms	Document text/html	82.200.247.240 KAZTELECOM-AS
General Check archive.org Show headers Download Go to Full URL http://www.consul.kz/templates/system/images/account/ib.nab.html Protocol HTTP/1.1 Server 82.200.247.240 , Kazakhstan, ASN9198 (KAZTELECOM-AS, KZ), Reverse DNS Software Apache / Resource Hash `0a4d26139c1a519c70acd9158665bfda0608502480775787aa87d0dad3bf59e6` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Wed, 26 Jul 2017 23:46:16 GMT Last-Modified Mon, 24 Jul 2017 01:33:07 GMT Server Apache ETag "4c0f-555063267024b" Content-Type text/html X-SERVER 2538 Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 19471
GET H/1.1	200 OK	reset.css ib.nab.com.au/nabib/styles/login/	607 B 375 B	24ms 24ms	Stylesheet text/css	23.43.30.163 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://ib.nab.com.au/nabib/styles/login/reset.css?id=17.2.2 Requested by Host: www.consul.kz URL: http://www.consul.kz/templates/system/images/account/ib.nab.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.43.30.163 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-43-30-163.deploy.static.akamaitechnologies.com Software / Resource Hash `1e61ffdfeb77f256dee30dd9b345b360df85c67bace0dc5092ee0afdc44d3e05` Request headers Referer http://www.consul.kz/templates/system/images/account/ib.nab.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Wed, 26 Jul 2017 23:48:00 GMT Content-Encoding gzip Last-Modified Tue, 04 Jul 2017 05:02:18 GMT ETag "19d12-25f-55376c9a78a80" Vary Accept-Encoding Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 375
GET H/1.1	200 OK	_template-styles.css ib.nab.com.au/nabib/styles/login/	20 KB 5 KB	21ms 21ms	Stylesheet text/css	23.43.30.163 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://ib.nab.com.au/nabib/styles/login/_template-styles.css?id=17.2.2 Requested by Host: www.consul.kz URL: http://www.consul.kz/templates/system/images/account/ib.nab.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.43.30.163 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-43-30-163.deploy.static.akamaitechnologies.com Software / Resource Hash `11421eb7f69105251f878f56a328c0d6ee4223e42848975770860cd1e7826971` Request headers Referer http://www.consul.kz/templates/system/images/account/ib.nab.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Wed, 26 Jul 2017 23:48:00 GMT Content-Encoding gzip Last-Modified Tue, 04 Jul 2017 05:02:18 GMT ETag "18d5f-5082-55376c9a78a80" Vary Accept-Encoding Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 4639
GET H/1.1	200 OK	_content-styles.css ib.nab.com.au/nabib/styles/login/	9 KB 2 KB	20ms 19ms	Stylesheet text/css	23.43.30.163 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://ib.nab.com.au/nabib/styles/login/_content-styles.css?id=17.2.2 Requested by Host: www.consul.kz URL: http://www.consul.kz/templates/system/images/account/ib.nab.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.43.30.163 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-43-30-163.deploy.static.akamaitechnologies.com Software / Resource Hash `fad7c2350c4488a86a067814c10df0fc2e4f5c3c8c041648e25e6b301180671a` Request headers Referer http://www.consul.kz/templates/system/images/account/ib.nab.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Wed, 26 Jul 2017 23:48:00 GMT Content-Encoding gzip Last-Modified Tue, 04 Jul 2017 05:02:18 GMT ETag "19d0c-2382-55376c9a78a80" Vary Accept-Encoding Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 2343
GET H/1.1	200 OK	added-styles.css ib.nab.com.au/nabib/styles/login/	3 KB 968 B	20ms 20ms	Stylesheet text/css	23.43.30.163 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://ib.nab.com.au/nabib/styles/login/added-styles.css?id=17.2.2 Requested by Host: www.consul.kz URL: http://www.consul.kz/templates/system/images/account/ib.nab.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.43.30.163 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-43-30-163.deploy.static.akamaitechnologies.com Software / Resource Hash `7949484cd8b9b52618e7a5112b0e91223f3088c18589c159a35ea464c236fb86` Request headers Referer http://www.consul.kz/templates/system/images/account/ib.nab.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Wed, 26 Jul 2017 23:48:00 GMT Content-Encoding gzip Last-Modified Tue, 04 Jul 2017 05:02:18 GMT ETag "18d60-ad1-55376c9a78a80" Vary Accept-Encoding Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 968
GET H/1.1	200 OK	_campaign-styles.css ib.nab.com.au/nabib/styles/login/	1 KB 515 B	20ms 20ms	Stylesheet text/css	23.43.30.163 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://ib.nab.com.au/nabib/styles/login/_campaign-styles.css?id=17.2.2 Requested by Host: www.consul.kz URL: http://www.consul.kz/templates/system/images/account/ib.nab.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.43.30.163 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-43-30-163.deploy.static.akamaitechnologies.com Software / Resource Hash `9f13e12d8b1f6c252ad672c74de8ae31353320e71c524b5a94721313b6401588` Request headers Referer http://www.consul.kz/templates/system/images/account/ib.nab.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Wed, 26 Jul 2017 23:48:00 GMT Content-Encoding gzip Last-Modified Tue, 04 Jul 2017 05:02:18 GMT ETag "18d5b-5b6-55376c9a78a80" Vary Accept-Encoding Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 515
GET H/1.1	200 OK	_ibRedesign-styles.css ib.nab.com.au/nabib/styles/login/	6 KB 2 KB	21ms 21ms	Stylesheet text/css	23.43.30.163 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://ib.nab.com.au/nabib/styles/login/_ibRedesign-styles.css?id=17.2.2 Requested by Host: www.consul.kz URL: http://www.consul.kz/templates/system/images/account/ib.nab.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.43.30.163 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-43-30-163.deploy.static.akamaitechnologies.com Software / Resource Hash `44686cd070e16e3543195b1c67f8f6b2cde02528894340961372f269f939b8ee` Request headers Referer http://www.consul.kz/templates/system/images/account/ib.nab.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Wed, 26 Jul 2017 23:48:00 GMT Content-Encoding gzip Last-Modified Tue, 04 Jul 2017 05:02:18 GMT ETag "19d0d-174c-55376c9a78a80" Vary Accept-Encoding Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 1626
GET H/1.1	200 OK	_print-styles.css ib.nab.com.au/nabib/styles/login/	2 KB 736 B	40ms 20ms	Stylesheet text/css	23.43.30.163 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://ib.nab.com.au/nabib/styles/login/_print-styles.css?id=17.2.2 Requested by Host: www.consul.kz URL: http://www.consul.kz/templates/system/images/account/ib.nab.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.43.30.163 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-43-30-163.deploy.static.akamaitechnologies.com Software / Resource Hash `1cf5bc7b9465431a5ece0ba6438290ebc48a5b5c82e89bf91ba9ca216bc2f75c` Request headers Referer http://www.consul.kz/templates/system/images/account/ib.nab.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Wed, 26 Jul 2017 23:48:00 GMT Content-Encoding gzip Last-Modified Tue, 04 Jul 2017 05:02:18 GMT ETag "19d0e-718-55376c9a78a80" Vary Accept-Encoding Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 736
GET H/1.1	200 OK	jquery.fancybox-1.3.1.css ib.nab.com.au/nabib/scripts/fancybox/	8 KB 2 KB	40ms 20ms	Stylesheet text/css	23.43.30.163 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://ib.nab.com.au/nabib/scripts/fancybox/jquery.fancybox-1.3.1.css?id=17.2.2 Requested by Host: www.consul.kz URL: http://www.consul.kz/templates/system/images/account/ib.nab.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.43.30.163 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-43-30-163.deploy.static.akamaitechnologies.com Software / Resource Hash `1c9ca47cc5368eba18d4e0867b61d5818361d9143eb1c24aead6123de525ba28` Request headers Referer http://www.consul.kz/templates/system/images/account/ib.nab.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Wed, 26 Jul 2017 23:48:00 GMT Content-Encoding gzip Last-Modified Tue, 04 Jul 2017 05:00:24 GMT ETag "18c77-1fe2-55376c2dc0a00" Vary Accept-Encoding Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 1597
GET H/1.1	200 OK	logo_nab.png ib.nab.com.au/nabib/images/login/	5 KB 5 KB	20ms 20ms	Image image/png	23.43.30.163 Akamai Technologies
General Check archive.org Show headers Download Go to Show image Full URL https://ib.nab.com.au/nabib/images/login/logo_nab.png Requested by Host: www.consul.kz URL: http://www.consul.kz/templates/system/images/account/ib.nab.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.43.30.163 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-43-30-163.deploy.static.akamaitechnologies.com Software / Resource Hash `c8b5c36b604b175f0c6be6b98f40c5b82c05b0a76aadd383a61b0f4fe0b3d264` Request headers Referer http://www.consul.kz/templates/system/images/account/ib.nab.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Wed, 26 Jul 2017 23:48:00 GMT Last-Modified Tue, 04 Jul 2017 05:00:22 GMT Connection keep-alive Accept-Ranges bytes ETag "18959-134f-55376c2bd8580" Content-Length 4943 Content-Type image/png
GET H/1.1	200 OK	gr_arrow-1.png ib.nab.com.au/nabib/images/login/	154 B 154 B	20ms 20ms	Image image/png	23.43.30.163 Akamai Technologies
General Check archive.org Show headers Download Go to Show image Full URL https://ib.nab.com.au/nabib/images/login/gr_arrow-1.png Requested by Host: www.consul.kz URL: http://www.consul.kz/templates/system/images/account/ib.nab.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.43.30.163 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-43-30-163.deploy.static.akamaitechnologies.com Software / Resource Hash `c7a299c1e3976b682508aeac5138f2f31b289d350e94bbd3ccc4f7570b67dcd0` Request headers Referer https://ib.nab.com.au/nabib/styles/login/_ibRedesign-styles.css?id=17.2.2 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Wed, 26 Jul 2017 23:48:00 GMT Last-Modified Tue, 04 Jul 2017 05:00:22 GMT Connection keep-alive Accept-Ranges bytes ETag "18934-9a-55376c2bd8580" Content-Length 154 Content-Type image/png
GET H/1.1	200 OK	bg_banner-2.jpg ib.nab.com.au/nabib/images/login/	19 KB 19 KB	28ms 28ms	Image image/jpeg	23.43.30.163 Akamai Technologies
General Check archive.org Show headers Download Go to Show image Full URL https://ib.nab.com.au/nabib/images/login/bg_banner-2.jpg Requested by Host: www.consul.kz URL: http://www.consul.kz/templates/system/images/account/ib.nab.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.43.30.163 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-43-30-163.deploy.static.akamaitechnologies.com Software / Resource Hash `04ff4054aedfdc46f0358f8f145717259c3d264f78837b8eb3bdb46024315947` Request headers Referer https://ib.nab.com.au/nabib/styles/login/_ibRedesign-styles.css?id=17.2.2 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Wed, 26 Jul 2017 23:48:00 GMT Last-Modified Tue, 04 Jul 2017 05:00:22 GMT Connection keep-alive Accept-Ranges bytes ETag "1892e-4a28-55376c2bd8580" Content-Length 18984 Content-Type image/jpeg
GET		corpid-b-webfont.woff ib.nab.com.au/nabib/webfonts/	0 0

GET		corpid-l-webfont.woff ib.nab.com.au/nabib/webfonts/	0 0

GET H/1.1	200 OK	bg_input_user.gif ib.nab.com.au/nabib/images/login/	257 B 257 B	19ms 19ms	Image image/gif	23.43.30.163 Akamai Technologies
General Check archive.org Show headers Download Go to Show image Full URL https://ib.nab.com.au/nabib/images/login/bg_input_user.gif Requested by Host: www.consul.kz URL: http://www.consul.kz/templates/system/images/account/ib.nab.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.43.30.163 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-43-30-163.deploy.static.akamaitechnologies.com Software / Resource Hash `4c27e00efc3a284d6406cbe4838292288fd65fb135cb303902e682e7a7a5f473` Request headers Referer https://ib.nab.com.au/nabib/styles/login/_ibRedesign-styles.css?id=17.2.2 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Wed, 26 Jul 2017 23:48:00 GMT Last-Modified Tue, 04 Jul 2017 05:00:22 GMT Connection keep-alive Accept-Ranges bytes ETag "1892f-101-55376c2bd8580" Content-Length 257 Content-Type image/gif
GET H/1.1	200 OK	ico_sprite.gif ib.nab.com.au/nabib/images/login/	2 KB 2 KB	19ms 19ms	Image image/gif	23.43.30.163 Akamai Technologies
General Check archive.org Show headers Download Go to Show image Full URL https://ib.nab.com.au/nabib/images/login/ico_sprite.gif Requested by Host: www.consul.kz URL: http://www.consul.kz/templates/system/images/account/ib.nab.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.43.30.163 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-43-30-163.deploy.static.akamaitechnologies.com Software / Resource Hash `a0f7466886559e2f009b59c21c80021e45a6b9911f5e25a6e96879c16b269b72` Request headers Referer https://ib.nab.com.au/nabib/styles/login/_ibRedesign-styles.css?id=17.2.2 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Wed, 26 Jul 2017 23:48:00 GMT Last-Modified Tue, 04 Jul 2017 05:00:22 GMT Connection keep-alive Accept-Ranges bytes ETag "1894b-6ba-55376c2bd8580" Content-Length 1722 Content-Type image/gif
GET		corpid-b-webfont.ttf ib.nab.com.au/nabib/webfonts/	0 0

GET H/1.1	200 OK	login-button-md.png www.clker.com/cliparts/W/N/3/S/7/v/	6 KB 6 KB	298ms 149ms	Image image/png	45.33.109.129 LINODE-AP Linode
General Check archive.org Show headers Download Go to Show image Full URL http://www.clker.com/cliparts/W/N/3/S/7/v/login-button-md.png Requested by Host: www.consul.kz URL: http://www.consul.kz/templates/system/images/account/ib.nab.html Protocol HTTP/1.1 Server 45.33.109.129 Fremont, United States, ASN63949 (LINODE-AP Linode, LLC, US), Reverse DNS li1436-129.members.linode.com Software Apache/2.4.18 (Ubuntu) / Resource Hash `e815ce37da2272f595561d159719dbb7c24e3d557125a8490c0a44bf0a889945` Request headers Referer http://www.consul.kz/templates/system/images/account/ib.nab.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Wed, 26 Jul 2017 23:48:01 GMT Last-Modified Tue, 12 Feb 2013 11:16:11 GMT Server Apache/2.4.18 (Ubuntu) ETag "1854-4d585272a9cf5" Content-Type image/png Cache-Control max-age=29030400, public Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 6228
GET S	404	NAB_Defence.gif www.nab.com.au/nabib/images/login/	232 B 0	375ms 375ms	Image text/html	104.108.49.155 Akamai Technologies
General Check archive.org Show headers Download Go to Show image Full URL https://www.nab.com.au/nabib/images/login/NAB_Defence.gif Requested by Host: www.consul.kz URL: http://www.consul.kz/templates/system/images/account/ib.nab.html Protocol SPDY Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.108.49.155 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a104-108-49-155.deploy.static.akamaitechnologies.com Software IBM_HTTP_Server / Resource Hash `701cbd22ba8d008f37ba9b4f73bdbf8ba1fa88262bf686c9c2911eb2a6340f40` Request headers Referer http://www.consul.kz/templates/system/images/account/ib.nab.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers status 404 date Wed, 26 Jul 2017 23:48:01 GMT server IBM_HTTP_Server content-length 232 content-type text/html; charset=iso-8859-1
GET		/ www.nab.com.au/static/IB/loginBanner/ Frame 2876	0 0

GET H/1.1	404 Not Found	bg_arrow_black.gif ib.nab.com.au/images/login/	295 B 0	366ms 366ms	Image text/html	23.43.30.163 Akamai Technologies
General Check archive.org Show headers Download Go to Show image Full URL https://ib.nab.com.au/images/login/bg_arrow_black.gif Requested by Host: www.consul.kz URL: http://www.consul.kz/templates/system/images/account/ib.nab.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.43.30.163 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-43-30-163.deploy.static.akamaitechnologies.com Software / Resource Hash `7824ab6834c8f36fd50731c240871a990853e5b1ebbbdb8750edf415a4198aaf` Request headers Referer http://www.consul.kz/templates/system/images/account/ib.nab.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Wed, 26 Jul 2017 23:48:01 GMT Content-Encoding gzip Connection keep-alive Content-Length 242 Vary Accept-Encoding Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	gr_dot-1.gif ib.nab.com.au/nabib/images/login/	68 B 68 B	47ms 47ms	Image image/gif	23.43.30.163 Akamai Technologies
General Check archive.org Show headers Download Go to Show image Full URL https://ib.nab.com.au/nabib/images/login/gr_dot-1.gif Requested by Host: www.consul.kz URL: http://www.consul.kz/templates/system/images/account/ib.nab.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.43.30.163 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-43-30-163.deploy.static.akamaitechnologies.com Software / Resource Hash `aded0530b852996f0f6d0bdee146023d096aa2c7990805c8f1f90456172b7892` Request headers Referer https://ib.nab.com.au/nabib/styles/login/_template-styles.css?id=17.2.2 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Wed, 26 Jul 2017 23:48:00 GMT X-Pad avoid browser bug Last-Modified Tue, 04 Jul 2017 05:00:22 GMT ETag "1893a-44-55376c2bd8580" Content-Type image/gif Connection keep-alive Accept-Ranges bytes Content-Length 68
GET H/1.1	200 OK	footer-icon-facebook.gif ib.nab.com.au/nabib/images/	581 B 581 B	19ms 19ms	Image image/gif	23.43.30.163 Akamai Technologies
General Check archive.org Show headers Download Go to Show image Full URL https://ib.nab.com.au/nabib/images/footer-icon-facebook.gif Requested by Host: www.consul.kz URL: http://www.consul.kz/templates/system/images/account/ib.nab.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.43.30.163 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-43-30-163.deploy.static.akamaitechnologies.com Software / Resource Hash `b59dac6fad9c97244268d80748845bb6efac3bac4999809675e742e21c0cfac4` Request headers Referer https://ib.nab.com.au/nabib/styles/login/_ibRedesign-styles.css?id=17.2.2 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Wed, 26 Jul 2017 23:48:00 GMT Last-Modified Tue, 04 Jul 2017 05:00:22 GMT Connection keep-alive Accept-Ranges bytes ETag "1887f-245-55376c2bd8580" Content-Length 581 Content-Type image/gif
GET H/1.1	200 OK	footer-icon-twitter.gif ib.nab.com.au/nabib/images/	449 B 449 B	19ms 19ms	Image image/gif	23.43.30.163 Akamai Technologies
General Check archive.org Show headers Download Go to Show image Full URL https://ib.nab.com.au/nabib/images/footer-icon-twitter.gif Requested by Host: www.consul.kz URL: http://www.consul.kz/templates/system/images/account/ib.nab.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.43.30.163 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-43-30-163.deploy.static.akamaitechnologies.com Software / Resource Hash `740b92b37caf1906cd34828753b3c60f3f92fa7d89c172a757ae8ddb229c413b` Request headers Referer https://ib.nab.com.au/nabib/styles/login/_ibRedesign-styles.css?id=17.2.2 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Wed, 26 Jul 2017 23:48:00 GMT Last-Modified Tue, 04 Jul 2017 05:00:22 GMT Connection keep-alive Accept-Ranges bytes ETag "18881-1c1-55376c2bd8580" Content-Length 449 Content-Type image/gif
GET H/1.1	200 OK	footer-icon-gplus.gif ib.nab.com.au/nabib/images/	1 KB 1 KB	33ms 19ms	Image image/gif	23.43.30.163 Akamai Technologies
General Check archive.org Show headers Download Go to Show image Full URL https://ib.nab.com.au/nabib/images/footer-icon-gplus.gif Requested by Host: www.consul.kz URL: http://www.consul.kz/templates/system/images/account/ib.nab.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.43.30.163 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-43-30-163.deploy.static.akamaitechnologies.com Software / Resource Hash `345e5797bde0b78107d25a3ab912482a2009a90dcc37c61e10f04bdf90a5c9e6` Request headers Referer https://ib.nab.com.au/nabib/styles/login/_ibRedesign-styles.css?id=17.2.2 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Wed, 26 Jul 2017 23:48:00 GMT Last-Modified Tue, 04 Jul 2017 05:00:22 GMT Connection keep-alive Accept-Ranges bytes ETag "18880-416-55376c2bd8580" Content-Length 1046 Content-Type image/gif
GET H/1.1	200 OK	footer-icon-youtube.gif ib.nab.com.au/nabib/images/	1 KB 1 KB	20ms 20ms	Image image/gif	23.43.30.163 Akamai Technologies
General Check archive.org Show headers Download Go to Show image Full URL https://ib.nab.com.au/nabib/images/footer-icon-youtube.gif Requested by Host: www.consul.kz URL: http://www.consul.kz/templates/system/images/account/ib.nab.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.43.30.163 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-43-30-163.deploy.static.akamaitechnologies.com Software / Resource Hash `4b0f8a88bea8e8300faf9c6eb50d989aed7b008262dd482f78ed3e340251adc5` Request headers Referer https://ib.nab.com.au/nabib/styles/login/_ibRedesign-styles.css?id=17.2.2 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Wed, 26 Jul 2017 23:48:00 GMT Last-Modified Tue, 04 Jul 2017 05:00:22 GMT Connection keep-alive Accept-Ranges bytes ETag "18882-4b0-55376c2bd8580" Content-Length 1200 Content-Type image/gif
GET H/1.1	200 OK	gr_bg_btn01.gif ib.nab.com.au/nabib/images/login/	274 B 274 B	20ms 20ms	Image image/gif	23.43.30.163 Akamai Technologies
General Check archive.org Show headers Download Go to Show image Full URL https://ib.nab.com.au/nabib/images/login/gr_bg_btn01.gif Requested by Host: www.consul.kz URL: http://www.consul.kz/templates/system/images/account/ib.nab.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.43.30.163 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-43-30-163.deploy.static.akamaitechnologies.com Software / Resource Hash `047532b80749cd876978ef5149876f804837410fbc2ad12b79857f34622e2583` Request headers Referer https://ib.nab.com.au/nabib/styles/login/_ibRedesign-styles.css?id=17.2.2 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Wed, 26 Jul 2017 23:48:00 GMT Last-Modified Tue, 04 Jul 2017 05:00:22 GMT Connection keep-alive Accept-Ranges bytes ETag "18936-112-55376c2bd8580" Content-Length 274 Content-Type image/gif
GET		corpid-l-webfont.ttf ib.nab.com.au/nabib/webfonts/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: ib.nab.com.au
URL: https://ib.nab.com.au/nabib/webfonts/corpid-b-webfont.woff

Domain: ib.nab.com.au
URL: https://ib.nab.com.au/nabib/webfonts/corpid-l-webfont.woff

Domain: ib.nab.com.au
URL: https://ib.nab.com.au/nabib/webfonts/corpid-b-webfont.ttf

Domain: www.nab.com.au
URL: https://www.nab.com.au/static/IB/loginBanner/

Domain: ib.nab.com.au
URL: https://ib.nab.com.au/nabib/webfonts/corpid-l-webfont.ttf

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: NAB Bank (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

31 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.adnxs.com/	2017-10-24 23:48:02	Name: icu Value: ChIIo6wwEAoYASABKAEwtNTkywUQtNTkywUYAA..
.demdex.net/	2019-07-26 23:48:02	Name: DST Value: ""
.doubleclick.net/	2019-07-26 23:48:02	Name: IDE Value: AHWqTUmJx1RXSkxRghlXgW5wiXQT3CAhl8vMnelCWWVd-t-GfQbNnOLlbg
.adnxs.com/	2017-07-27 23:48:02	Name: sess Value: 1
.demdex.net/	2018-01-22 23:48:02	Name: demdex Value: 86006589084880915673042257636433386237
.nab.com.au/	1970-01-01 00:00:00	Name: s_cc Value: true
www.nab.com.au/	2017-07-27 23:48:02	Name: _bizo_np_stats Value: 1640%3D48%2C155%3D79%2C
.nab.com.au/	2017-07-27 00:18:02	Name: s_invisit Value: true
.nab.com.au/	2017-08-01 00:00:00	Name: s_vnum Value: 1501545600048%26vn%3D1
.nab.com.au/	2017-07-27 00:18:02	Name: gpv_pN Value: nab%3Aib-platform%3Alogin
www.nab.com.au/	2017-07-27 00:18:02	Name: _uetsid Value: _uet591dccfe
.nab.com.au/	2019-07-26 23:48:01	Name: AMCV_4986658252DDA4900A490D4D%40AdobeOrg Value: -1758798782%7CMCIDTS%7C17374%7CMCMID%7C88239027653466105322264948499354678992%7CMCAAMLH-1501717681%7C6%7CMCAAMB-1501717681%7CNRX38WO0n5BH8Th-nqAG_A%7CMCOPTOUT-1501120081s%7CNONE%7CMCAID%7CNONE
.demdex.net/	2018-01-22 23:48:02	Name: dextp Value: 358-1-1501112882499
.nab.com.au/	2017-07-27 00:19:02	Name: mbox Value: session#1501112881709-337830#1501114742
.adnxs.com/	2017-10-24 23:48:02	Name: anj Value: dTM7k!M4/8DYRWSF']wIg2Il_eUDF#!]tbPB*SQLOsH`E.g3VsQtBvc
.nab.com.au/	2022-07-26 23:48:02	Name: s_atx Value: %5B%5B%27Other%2520Natural%2520Referrers%27%2C%271501112882049%27%5D%5D
.nab.com.au/	2017-08-25 23:48:02	Name: aam_uuid Value: 86006589084880915673042257636433386237
.nab.com.au/	2022-07-26 23:48:02	Name: s_kywd Value: %5B%5B%27n%2Fa%27%2C%271501112882050%27%5D%5D
.adnxs.com/	2017-10-24 23:48:02	Name: uuid2 Value: 7474236008770512705
.nab.com.au/	1970-01-01 00:00:00	Name: s_cm Value: Other%20Natural%20Referrersundefinedwww.consul.kzwww.consul.kz
www.nab.com.au/	2017-07-27 23:48:02	Name: _bizo_bzid Value: 1dc64d01-1618-45a7-ab8d-2db9289719b1
.nab.com.au/	2017-07-27 00:18:02	Name: dl Value: 1
.nab.com.au/	1970-01-01 00:00:00	Name: s_sq Value: %5B%5BB%5D%5D
www.nab.com.au/	1970-01-01 00:00:00	Name: sync_s_vi Value: sync
.nab.com.au/	2017-08-25 23:48:02	Name: s_nr Value: 1501112882050-New
.nab.com.au/	1970-01-01 00:00:00	Name: sync_nexussid Value: sync
www.nab.com.au/	2017-07-27 23:48:02	Name: _bizo_cksm Value: 683A2E86690FACA8
.nab.demdex.net/	2018-01-22 23:48:02	Name: nab Value: 86006589084880915673042257636433386237
.nab.com.au/	1970-01-01 00:00:00	Name: AMCVS_4986658252DDA4900A490D4D%40AdobeOrg Value: 1
.nab.com.au/	2022-07-26 23:48:02	Name: s_cid Value: %5B%5B%27www.consul.kz%27%2C%271501112882049%27%5D%5D
.doubleclick.net/	2019-07-26 23:48:02	Name: id Value: 225b8c57824b0015\|\|t=1501112882\|et=730\|cs=002213fd48b901dd192661ef32

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ib.nab.com.au
www.clker.com
www.consul.kz
www.nab.com.au
ib.nab.com.au
www.nab.com.au
104.108.49.155
23.43.30.163
45.33.109.129
82.200.247.240
047532b80749cd876978ef5149876f804837410fbc2ad12b79857f34622e2583
04ff4054aedfdc46f0358f8f145717259c3d264f78837b8eb3bdb46024315947
0a4d26139c1a519c70acd9158665bfda0608502480775787aa87d0dad3bf59e6
11421eb7f69105251f878f56a328c0d6ee4223e42848975770860cd1e7826971
1c9ca47cc5368eba18d4e0867b61d5818361d9143eb1c24aead6123de525ba28
1cf5bc7b9465431a5ece0ba6438290ebc48a5b5c82e89bf91ba9ca216bc2f75c
1e61ffdfeb77f256dee30dd9b345b360df85c67bace0dc5092ee0afdc44d3e05
345e5797bde0b78107d25a3ab912482a2009a90dcc37c61e10f04bdf90a5c9e6
44686cd070e16e3543195b1c67f8f6b2cde02528894340961372f269f939b8ee
4b0f8a88bea8e8300faf9c6eb50d989aed7b008262dd482f78ed3e340251adc5
4c27e00efc3a284d6406cbe4838292288fd65fb135cb303902e682e7a7a5f473
701cbd22ba8d008f37ba9b4f73bdbf8ba1fa88262bf686c9c2911eb2a6340f40
740b92b37caf1906cd34828753b3c60f3f92fa7d89c172a757ae8ddb229c413b
7824ab6834c8f36fd50731c240871a990853e5b1ebbbdb8750edf415a4198aaf
7949484cd8b9b52618e7a5112b0e91223f3088c18589c159a35ea464c236fb86
9f13e12d8b1f6c252ad672c74de8ae31353320e71c524b5a94721313b6401588
a0f7466886559e2f009b59c21c80021e45a6b9911f5e25a6e96879c16b269b72
aded0530b852996f0f6d0bdee146023d096aa2c7990805c8f1f90456172b7892
b59dac6fad9c97244268d80748845bb6efac3bac4999809675e742e21c0cfac4
c7a299c1e3976b682508aeac5138f2f31b289d350e94bbd3ccc4f7570b67dcd0
c8b5c36b604b175f0c6be6b98f40c5b82c05b0a76aadd383a61b0f4fe0b3d264
e815ce37da2272f595561d159719dbb7c24e3d557125a8490c0a44bf0a889945
fad7c2350c4488a86a067814c10df0fc2e4f5c3c8c041648e25e6b301180671a

www.consul.kz Open in urlscan Pro 82.200.247.240 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

28 Requests

75 %HTTPS

0 %IPv6

3 Domains

4 Subdomains

5 IPs

3 Countries

67 kBTransfer

104 kBSize

31 Cookies

1 Outgoing links

Redirected requests

28 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

31 Cookies

Indicators

www.consul.kz Open in urlscan Pro
82.200.247.240 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

28
Requests

75 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

5
IPs

3
Countries

67 kB
Transfer

104 kB
Size

31
Cookies

28 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!