s3.jawab.app
Open in
urlscan Pro
168.119.109.88
Malicious Activity!
Public Scan
Submission: On January 13 via automatic, source openphish — Scanned from DE
Summary
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on July 21st 2022. Valid for: a year.
This is the only time s3.jawab.app was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: NAB Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 168.119.109.88 168.119.109.88 | 24940 (HETZNER-AS) (HETZNER-AS) | |
4 | 2a04:4e42:200... 2a04:4e42:200::485 | 54113 (FASTLY) (FASTLY) | |
2 | 23.45.96.185 23.45.96.185 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
1 | 23.45.100.54 23.45.100.54 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
12 | 5 |
ASN24940 (HETZNER-AS, DE)
PTR: static.88.109.119.168.clients.your-server.de
s3.jawab.app |
ASN16625 (AKAMAI-AS, US)
PTR: a23-45-96-185.deploy.static.akamaitechnologies.com
ib.nab.com.au |
ASN16625 (AKAMAI-AS, US)
PTR: a23-45-100-54.deploy.static.akamaitechnologies.com
www.nab.com.au |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 355 |
76 KB |
3 |
nab.com.au
ib.nab.com.au www.nab.com.au — Cisco Umbrella Rank: 546767 |
215 KB |
1 |
jawab.app
s3.jawab.app |
12 KB |
0 |
discordapp.com
Failed
cdn.discordapp.com Failed |
|
12 | 4 |
Domain | Requested by | |
---|---|---|
4 | cdn.jsdelivr.net |
s3.jawab.app
|
2 | ib.nab.com.au |
s3.jawab.app
|
1 | www.nab.com.au |
s3.jawab.app
|
1 | s3.jawab.app | |
0 | cdn.discordapp.com Failed |
s3.jawab.app
|
12 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.nab.com.au |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.jawab.app Go Daddy Secure Certificate Authority - G2 |
2022-07-21 - 2023-08-22 |
a year | crt.sh |
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2022 Q4 |
2022-12-23 - 2024-01-24 |
a year | crt.sh |
ib.nab.com.au Entrust Certification Authority - L1M |
2022-09-29 - 2023-10-19 |
a year | crt.sh |
www.nab.com.au Entrust Certification Authority - L1M |
2022-09-28 - 2023-10-28 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://s3.jawab.app/chat/reports/FirstOpenReport/secondpage.html
Frame ID: A81602BE77A45CC5C42F73FC9EDBB4C3
Requests: 12 HTTP requests in this frame
Screenshot
Page Title
NAB Internet BankingDetected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
jsDelivr (CDN) Expand
Detected patterns
- <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
- //cdn\.jsdelivr\.net/
Page Statistics
4 Outgoing links
These are links going to different origins than the main page.
Title: Help
Search URL Search Domain Scan URL
Title: Security
Search URL Search Domain Scan URL
Title: Contact us
Search URL Search Domain Scan URL
Title: Locate us
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
secondpage.html
s3.jawab.app/chat/reports/FirstOpenReport/ |
12 KB 12 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.3.0-alpha1/dist/css/ |
216 KB 30 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.bundle.min.js
cdn.jsdelivr.net/npm/bootstrap@5.3.0-alpha1/dist/js/ |
79 KB 23 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
popper.min.js
cdn.jsdelivr.net/npm/@popperjs/core@2.11.6/dist/umd/ |
20 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
cdn.jsdelivr.net/npm/bootstrap@5.3.0-alpha1/dist/js/ |
59 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
star_nab_more.03a9540d7ae7a72c39c235f7e58679c3.svg
ib.nab.com.au/reno/shell/v4.34.0/assets/ |
9 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ib-login-banner2-1797x800.jpg
www.nab.com.au/content/dam/nabrwd/images/types/backgrounds/ |
190 KB 190 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
SourceSansPro-Regular.otf
cdn.discordapp.com/attachments/1063193995964067913/1063197569141977139/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
SourceSansPro-Light.otf
cdn.discordapp.com/attachments/1063193995964067913/1063194903712104548/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
SourceSansPro-Semibold.otf
cdn.discordapp.com/attachments/1063193995964067913/1063197868590125127/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
SourceSansPro-Bold.otf
cdn.discordapp.com/attachments/1063193995964067913/1063197755658485810/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Gw96ch4
ib.nab.com.au/EcHi/Wn0n/F/P1/FBhyBiA/zipuNwpG/QwpAMw/M0lx/ |
84 KB 21 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- cdn.discordapp.com
- URL
- https://cdn.discordapp.com/attachments/1063193995964067913/1063197569141977139/SourceSansPro-Regular.otf
- Domain
- cdn.discordapp.com
- URL
- https://cdn.discordapp.com/attachments/1063193995964067913/1063194903712104548/SourceSansPro-Light.otf
- Domain
- cdn.discordapp.com
- URL
- https://cdn.discordapp.com/attachments/1063193995964067913/1063197868590125127/SourceSansPro-Semibold.otf
- Domain
- cdn.discordapp.com
- URL
- https://cdn.discordapp.com/attachments/1063193995964067913/1063197755658485810/SourceSansPro-Bold.otf
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: NAB Bank (Banking)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontentvisibilityautostatechange number| uidEvent object| bootstrap object| Popper string| today2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
ib.nab.com.au/ | Name: akacd_ib_nab_com_au Value: 3851026305~rv=79~id=5b50ba3190bd5903291849a03850d4ee |
|
www.nab.com.au/ | Name: akacd_www_nab_com_au Value: 3851026306~rv=50~id=a020b5df2cc6a98239e70a184e880a92 |
9 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | block-all-mixed-content |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.discordapp.com
cdn.jsdelivr.net
ib.nab.com.au
s3.jawab.app
www.nab.com.au
cdn.discordapp.com
168.119.109.88
23.45.100.54
23.45.96.185
2a04:4e42:200::485
051a8137b75880006ab58f47778ca713ed6c967130faba043c5cd0ed34517dc8
061f0b1ea79e6e2ca24f4603e55d3e909f7471ba0b279cdb6dea40554106c6a2
34f2409f58b3fd380f8efcde331e18531e6c4bce3ac22ffaa01ef2a8ed2efd4b
932ea15108928991bcf0c0a46415fc652de5ffc0158c35205357b90c65eeb386
ae5236e34084bcd18482a6b5422eb58b52373b767a5398448ecb59d1293aec61
ce56c017a4b04dd507163f35d6c09d6c28ca91b7d468fd808cdc3a50358cad1c
eaa5a0f93d160bb09361d0e50ea7b683981b432fe751167b47dbc652003a8f90
fa43fd4073d3976c0bc94de0d58e6f81290443515528b60e80aa889fa38f80c2