redherring.be
Open in
urlscan Pro
185.58.96.92
Malicious Activity!
Public Scan
Submission: On March 24 via api from IE — Scanned from DE
Summary
TLS certificate: Issued by R3 on February 21st 2023. Valid for: 3 months.
This is the only time redherring.be was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: NAB Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 23 | 185.58.96.92 185.58.96.92 | 39923 (AS-UNIXSO...) (AS-UNIXSOLUTIONS Unix-Solutions Network) | |
1 | 92.122.106.139 92.122.106.139 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
21 | 2 |
ASN39923 (AS-UNIXSOLUTIONS Unix-Solutions Network, BE)
PTR: web2.gigaserving.com
redherring.be |
ASN16625 (AKAMAI-AS, US)
PTR: a92-122-106-139.deploy.static.akamaitechnologies.com
www.nab.com.au |
Apex Domain Subdomains |
Transfer | |
---|---|---|
23 |
redherring.be
3 redirects
redherring.be |
465 KB |
1 |
nab.com.au
www.nab.com.au — Cisco Umbrella Rank: 524861 |
118 KB |
21 | 2 |
Domain | Requested by | |
---|---|---|
23 | redherring.be |
3 redirects
redherring.be
|
1 | www.nab.com.au |
redherring.be
|
21 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
ib.nab.com.au |
Subject Issuer | Validity | Valid | |
---|---|---|---|
redherring.be R3 |
2023-02-21 - 2023-05-22 |
3 months | crt.sh |
www.nab.com.au Entrust Certification Authority - L1M |
2022-09-28 - 2023-10-28 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://redherring.be/wp-includes/customize/cgiawe/home/login/nab/
Frame ID: CA4A864B369AE72124EDFA5B0F0A10EB
Requests: 21 HTTP requests in this frame
Screenshot
Page Title
NAB Internet BankingDetected technologies
WordPress (CMS) ExpandDetected patterns
- /wp-(?:content|includes)/
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Skip to main content
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 4- https://redherring.be/wp-includes/customize/cgiawe/home/login/nab/assets/loader.js HTTP 301
- https://redherring.be/wp-includes/customize/cgiawe/home/login/nab/assets/loader.js/
- https://redherring.be/wp-includes/customize/cgiawe/home/login/nab/assets/assets/epilogue-600.277829caedf33fa33e47d9c481d2fb10.woff2 HTTP 301
- https://redherring.be/wp-includes/customize/cgiawe/home/login/nab/assets/assets/epilogue-600.277829caedf33fa33e47d9c481d2fb10.woff2/
- https://redherring.be/wp-includes/customize/cgiawe/home/login/nab/assets/assets/epilogue-600.c572a4203877394bb74874558461e2ad.woff HTTP 301
- https://redherring.be/wp-includes/customize/cgiawe/home/login/nab/assets/assets/epilogue-600.c572a4203877394bb74874558461e2ad.woff/
21 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
redherring.be/wp-includes/customize/cgiawe/home/login/nab/ |
28 KB 28 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
_ibRedesign-styles.css
redherring.be/wp-includes/customize/cgiawe/home/login/nab/assets/ |
8 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-3.6.0.min.js
redherring.be/wp-includes/customize/cgiawe/home/login/nab/assets/ |
87 KB 88 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
loader-page.css
redherring.be/wp-includes/customize/cgiawe/home/login/nab/assets/ |
3 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
loader.css
redherring.be/wp-includes/customize/cgiawe/home/login/nab/assets/ |
57 KB 57 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
redherring.be/wp-includes/customize/cgiawe/home/login/nab/assets/loader.js/ Redirect Chain
|
27 KB 27 KB |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
star_nab_more.03a9540d7ae7a72c39c235f7e58679c3.svg
redherring.be/wp-includes/customize/cgiawe/home/login/nab/assets/ |
9 KB 9 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
star_nab.49030fddae05ccbb4a82467133879db3.svg
redherring.be/wp-includes/customize/cgiawe/home/login/nab/assets/ |
3 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
font-sourcesanspro.css
redherring.be/wp-includes/customize/cgiawe/home/login/nab/assets/ |
2 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ib-components.css
redherring.be/wp-includes/customize/cgiawe/home/login/nab/assets/ |
7 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ib-login-banner2-1797x800.jpg
www.nab.com.au/content/dam/nabrwd/images/types/backgrounds/ |
118 KB 118 KB |
Image
image/avif |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
redherring.be/wp-includes/customize/cgiawe/home/login/nab/assets/assets/epilogue-600.277829caedf33fa33e47d9c481d2fb10.woff2/ Redirect Chain
|
27 KB 27 KB |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sourcesanspro-400.58dd2a1c6d7861ea261912ba153ac8e3.woff2
redherring.be/wp-includes/customize/cgiawe/home/login/nab/assets/fonts/ |
14 KB 14 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sourcesanspro-300.a8ae0d5401bb928346ea5696443d4909.woff2
redherring.be/wp-includes/customize/cgiawe/home/login/nab/assets/fonts/ |
14 KB 14 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sourcesanspro-600.605135ed81218e3c6926d6603a2aba14.woff2
redherring.be/wp-includes/customize/cgiawe/home/login/nab/assets/fonts/ |
18 KB 18 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sourcesanspro-700.c18b7366babf6ace33427f60cf7fa7e0.woff2
redherring.be/wp-includes/customize/cgiawe/home/login/nab/assets/fonts/ |
14 KB 14 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sourcesanspro-regular-webfont.woff
redherring.be/wp-includes/customize/cgiawe/home/login/nab/assets/fonts/ |
29 KB 29 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sourcesanspro-light-webfont.woff
redherring.be/wp-includes/customize/cgiawe/home/login/nab/assets/fonts/ |
29 KB 29 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sourcesanspro-semibold-webfont.woff
redherring.be/wp-includes/customize/cgiawe/home/login/nab/assets/fonts/ |
29 KB 29 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sourcesanspro-bold-webfont.woff
redherring.be/wp-includes/customize/cgiawe/home/login/nab/assets/fonts/ |
29 KB 29 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
redherring.be/wp-includes/customize/cgiawe/home/login/nab/assets/assets/epilogue-600.c572a4203877394bb74874558461e2ad.woff/ Redirect Chain
|
27 KB 27 KB |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: NAB Bank (Banking)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless function| $ function| jQuery1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.nab.com.au/ | Name: akacd_www_nab_com_au Value: 3857073903~rv=10~id=cdc675f50809f2a75ce983e1a902e126 |
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
redherring.be
www.nab.com.au
185.58.96.92
92.122.106.139
0767709fddbcd9ce91fa947dfcccb81317cd1ac28086e5b8ac70da250b6110f3
1516e6b886bc6416bfec631059887732b3e34b4109380384a7fe83af0558f739
15435827eb508b00a5a473032738918ece0a1a6baba4f2a8832d9e8b8d886587
33fba9380ebcf5465a9438d70c1ff01460e237442d8c5113e75e5006a4576aa4
424fc1bd41cdb376c29fed38dd1962336ec8482ab4b58dd3f57b22f2e441ab48
599d93e0748728edc6bd55a82a52bff61196b149d566a67d4ed86d55d9c520aa
6019f1a770d94603ac78997617cc19bb5a608d43ed59662a8e4755485b762a27
6c2b5c0a4bcd53ec948c1a5dcbcb73eeb0b45ab06f55ef51f599c04517073326
895b2a4707f964bde44b6543d155f6dc43ddf4bcff2dc46094789a7e313e07f0
9d7addb18466a521c4f63b155b82343ca0b4b4b05cfc35da15ac7f5d3d4f3b09
a07b6772c9e702f6f2b7b83e02f76515970eb54aeec4b7b7b00450a3b35594f3
a4fac6d6f6782da9cfe8d8c756d89953e2e1ca6a5340724385b948e083bbf569
a97d10cefd0d747b1db289932dddd94f0e651b70a60af08de5e254539cb4ddec
aef4f3c51bb81f7c1fcc34575283853733feb7fe536768cf3361893cbcf2360d
b7ca8ff0e0035b63d22472cece9ba2c7fcb377fa984a715c865f1cf4acea814c
c023c07272e16a150972863fbc304dc10b10f0e56589314af574a4157b19133d
c90a2d7b324ab5d54ca6c102248eb561257fa83832f626090ddc95bdaf46b6a2
ce56c017a4b04dd507163f35d6c09d6c28ca91b7d468fd808cdc3a50358cad1c
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e