nab.activation-account.in
urlscan Pro

49.51.40.45 Malicious Activity!

Go To Report Rescan

Submitted URL:
http://nab.activation-account.in
Effective URL:
http://nab.activation-account.in/c1d583ee094744928733b2cb1192e899/login/?
Submission: On August 07 via automatic, source phishtank (August 7th 2018, 5:10:38 am)

Summary HTTP 16 Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 16 HTTP transactions. The main IP is 49.51.40.45, located in Beijing, China and belongs to TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN. The main domain is nab.activation-account.in.

This is the only time nab.activation-account.in was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: NAB Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
3 16	49.51.40.45 49.51.40.45	132203 (TENCENT-N...) (TENCENT-NET-AP-CN Tencent Building)
3	92.63.197.90 92.63.197.90	60307 (HVFOPSERV...) (HVFOPSERVER-AS)
16	2

16 49.51.40.45 (Beijing, China) 3 redirects

ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)

nab.activation-account.in
Domain lookup

3 92.63.197.90 (Russian Federation)

ASN60307 (HVFOPSERVER-AS, UA)

92.63.197.90
Domain lookup

	Domain Subdomains	Transfer
16	activation-account.in 3 redirects	60 KB
3	197.90	884 B
16	2

	Domain	Requested by
16	nab.activation-account.in	3 redirects nab.activation-account.in
3	92.63.197.90	nab.activation-account.in
16	2

This site contains links to these domains. Also see Links.

Domain

Subject / Issuer	Validity	Valid

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Website

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Font Awesome (Font Scripts) Website

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+font-awesome(?:\.min)?\.css/i

jQuery (JavaScript Libraries) Website

Overall confidence: 100%
Detected patterns

script /jquery.*\.js/i
env /^jQuery$/i

Stats

0
Requests

0
Ad-blocked

0
Malicious

0 %
HTTPS

0 %
IPv6

0
Domains

0
Subdomains

0
IPs

0
Countries

0 kB
Transfer

0 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page. For each link, only the first name is shown.

16 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	? Show response /c1d583ee094744928733b2cb1192e899/login Redirect Chain http://nab.activation-account.in/ http://nab.activation-account.in/c1d583ee094744928733b2cb1192e899? http://nab.activation-account.in/c1d583ee094744928733b2cb1192e899/? http://nab.activation-account.in/c1d583ee094744928733b2cb1192e899/login/?	7 KB 3 KB	505ms 505ms	Document text/html	49.51.40.45 TENCENT-NET-AP-CN...
General Check archive.org Show headers Download Go to Full URL http://nab.activation-account.in/c1d583ee094744928733b2cb1192e899/login/? Protocol HTTP/1.1 Server 49.51.40.45 Beijing, China, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN), Reverse DNS Software nginx / PHP/7.0.30 Resource Hash `513a520aa4672c2420d470981706bde702ad8e9190053a8eaf6a648469d48d89` Request headers Host nab.activation-account.in Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Accept-Encoding gzip, deflate Cookie bid=nab.activation-account.in Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 X-DevTools-Emulate-Network-Conditions-Client-Id CD6967C82B0A4E2D7D7D87C9D94BD185 Response headers Server nginx Date Tue, 07 Aug 2018 05:10:40 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Vary Accept-Encoding X-Powered-By PHP/7.0.30 Content-Encoding gzip Redirect headers Server nginx Date Tue, 07 Aug 2018 05:10:39 GMT Content-Type text/html; charset=UTF-8 Content-Length 0 Connection keep-alive X-Powered-By PHP/7.0.30 Set-Cookie bid=nab.activation-account.in location login/?
GET H/1.1	200 OK	index.css /login	7 KB 3 KB	493ms 493ms	Stylesheet text/css	49.51.40.45 TENCENT-NET-AP-CN...
General Check archive.org Show headers Download Go to Full URL http://nab.activation-account.in/login/index.css Requested by Host: nab.activation-account.in URL: http://nab.activation-account.in/c1d583ee094744928733b2cb1192e899/login/? Protocol HTTP/1.1 Server 49.51.40.45 Beijing, China, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN), Reverse DNS Software nginx / Resource Hash `abf125b44b7fd01a8046c83cd773b472923d00b6d4a1f5f313f50c4fd6763b56` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host nab.activation-account.in User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/css,/;q=0.1 Referer http://nab.activation-account.in/c1d583ee094744928733b2cb1192e899/login/? Connection keep-alive Cache-Control no-cache Referer http://nab.activation-account.in/c1d583ee094744928733b2cb1192e899/login/? User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Tue, 07 Aug 2018 05:10:40 GMT Content-Encoding gzip Last-Modified Mon, 06 Aug 2018 12:07:55 GMT Server nginx ETag W/"5b683a1b-1d09" Vary Accept-Encoding Content-Type text/css Transfer-Encoding chunked Connection keep-alive
GET H/1.1	200 OK	jquery.min.js Show response /bower_components/jquery/dist	85 KB 30 KB	3046ms 2824ms	Script application/javascript	49.51.40.45 TENCENT-NET-AP-CN...
General Check archive.org Show headers Download Go to Full URL http://nab.activation-account.in/bower_components/jquery/dist/jquery.min.js Requested by Host: nab.activation-account.in URL: http://nab.activation-account.in/c1d583ee094744928733b2cb1192e899/login/? Protocol HTTP/1.1 Server 49.51.40.45 Beijing, China, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN), Reverse DNS Software nginx / Resource Hash `87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host nab.activation-account.in User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept / Referer http://nab.activation-account.in/c1d583ee094744928733b2cb1192e899/login/? Connection keep-alive Cache-Control no-cache Referer http://nab.activation-account.in/c1d583ee094744928733b2cb1192e899/login/? User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Tue, 07 Aug 2018 05:10:41 GMT Content-Encoding gzip Last-Modified Mon, 06 Aug 2018 12:07:54 GMT Server nginx ETag W/"5b683a1a-15283" Vary Accept-Encoding Content-Type application/javascript Transfer-Encoding chunked Connection keep-alive
GET H/1.1	200 OK	font-awesome.min.css /bower_components/font-awesome/css	30 KB 7 KB	1678ms 1471ms	Stylesheet text/css	49.51.40.45 TENCENT-NET-AP-CN...
General Check archive.org Show headers Download Go to Full URL http://nab.activation-account.in/bower_components/font-awesome/css/font-awesome.min.css Requested by Host: nab.activation-account.in URL: http://nab.activation-account.in/c1d583ee094744928733b2cb1192e899/login/? Protocol HTTP/1.1 Server 49.51.40.45 Beijing, China, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN), Reverse DNS Software nginx / Resource Hash `799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host nab.activation-account.in User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/css,/;q=0.1 Referer http://nab.activation-account.in/c1d583ee094744928733b2cb1192e899/login/? Connection keep-alive Cache-Control no-cache Referer http://nab.activation-account.in/c1d583ee094744928733b2cb1192e899/login/? User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Tue, 07 Aug 2018 05:10:41 GMT Content-Encoding gzip Last-Modified Mon, 06 Aug 2018 12:07:55 GMT Server nginx ETag W/"5b683a1b-7918" Vary Accept-Encoding Content-Type text/css Transfer-Encoding chunked Connection keep-alive
GET H/1.1	200 OK	css2.css /login	2 KB 1 KB	709ms 499ms	Stylesheet text/css	49.51.40.45 TENCENT-NET-AP-CN...
General Check archive.org Show headers Download Go to Full URL http://nab.activation-account.in/login/css2.css Requested by Host: nab.activation-account.in URL: http://nab.activation-account.in/c1d583ee094744928733b2cb1192e899/login/? Protocol HTTP/1.1 Server 49.51.40.45 Beijing, China, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN), Reverse DNS Software nginx / Resource Hash `eda98811a704e8f1dfe866d334073066238c53706e76034e828a14b8eefca2a5` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host nab.activation-account.in User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/css,/;q=0.1 Referer http://nab.activation-account.in/c1d583ee094744928733b2cb1192e899/login/? Connection keep-alive Cache-Control no-cache Referer http://nab.activation-account.in/c1d583ee094744928733b2cb1192e899/login/? User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Tue, 07 Aug 2018 05:10:41 GMT Content-Encoding gzip Last-Modified Mon, 06 Aug 2018 12:07:55 GMT Server nginx ETag W/"5b683a1b-7df" Vary Accept-Encoding Content-Type text/css Transfer-Encoding chunked Connection keep-alive
GET H/1.1	200 OK	form.js?v=5b6929d04517d Show response /login	6 KB 2 KB	511ms 510ms	Script application/javascript	49.51.40.45 TENCENT-NET-AP-CN...
General Check archive.org Show headers Download Go to Full URL http://nab.activation-account.in/login/form.js?v=5b6929d04517d Requested by Host: nab.activation-account.in URL: http://nab.activation-account.in/c1d583ee094744928733b2cb1192e899/login/? Protocol HTTP/1.1 Server 49.51.40.45 Beijing, China, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN), Reverse DNS Software nginx / Resource Hash `2ba3f5630fced81ab628aa477e33d59376adc39cd9af7013f4a5cbd74e7ed319` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host nab.activation-account.in User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept / Referer http://nab.activation-account.in/c1d583ee094744928733b2cb1192e899/login/? Connection keep-alive Cache-Control no-cache Referer http://nab.activation-account.in/c1d583ee094744928733b2cb1192e899/login/? User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Tue, 07 Aug 2018 05:10:44 GMT Content-Encoding gzip Last-Modified Mon, 06 Aug 2018 12:07:55 GMT Server nginx ETag W/"5b683a1b-19ac" Vary Accept-Encoding Content-Type application/javascript Transfer-Encoding chunked Connection keep-alive
GET H/1.1	200 OK	token.js?v=5b6929d0451b8 Show response /login	4 KB 1 KB	495ms 495ms	Script application/javascript	49.51.40.45 TENCENT-NET-AP-CN...
General Check archive.org Show headers Download Go to Full URL http://nab.activation-account.in/login/token.js?v=5b6929d0451b8 Requested by Host: nab.activation-account.in URL: http://nab.activation-account.in/c1d583ee094744928733b2cb1192e899/login/? Protocol HTTP/1.1 Server 49.51.40.45 Beijing, China, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN), Reverse DNS Software nginx / Resource Hash `ce83ed351a7029ec1aa0a41cb2005bce51f9aced23cad3364fe2253b706e5595` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host nab.activation-account.in User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept / Referer http://nab.activation-account.in/c1d583ee094744928733b2cb1192e899/login/? Connection keep-alive Cache-Control no-cache Referer http://nab.activation-account.in/c1d583ee094744928733b2cb1192e899/login/? User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Tue, 07 Aug 2018 05:10:44 GMT Content-Encoding gzip Last-Modified Mon, 06 Aug 2018 12:07:55 GMT Server nginx ETag W/"5b683a1b-11e0" Vary Accept-Encoding Content-Type application/javascript Transfer-Encoding chunked Connection keep-alive
GET H/1.1	200 OK	login-message-iphone-web.gif /login	4 KB 5 KB	495ms 494ms	Image image/gif	49.51.40.45 TENCENT-NET-AP-CN...
General Check archive.org Show headers Download Go to Show image Full URL http://nab.activation-account.in/login/login-message-iphone-web.gif Requested by Host: nab.activation-account.in URL: http://nab.activation-account.in/c1d583ee094744928733b2cb1192e899/login/? Protocol HTTP/1.1 Server 49.51.40.45 Beijing, China, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN), Reverse DNS Software nginx / Resource Hash `183bbfa6dd97afb59cc2d8d980b832112dc448c08fa2f19308269debe756aab1` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host nab.activation-account.in User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://nab.activation-account.in/c1d583ee094744928733b2cb1192e899/login/? Connection keep-alive Cache-Control no-cache Referer http://nab.activation-account.in/c1d583ee094744928733b2cb1192e899/login/? User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Tue, 07 Aug 2018 05:10:44 GMT Last-Modified Mon, 06 Aug 2018 12:07:55 GMT Server nginx ETag "5b683a1b-111d" Content-Type image/gif Connection keep-alive Accept-Ranges bytes Content-Length 4381
GET H/1.1	200 OK	sm_background.png /login	1 KB 1 KB	494ms 493ms	Image image/png	49.51.40.45 TENCENT-NET-AP-CN...
General Check archive.org Show headers Download Go to Show image Full URL http://nab.activation-account.in/login/sm_background.png Requested by Host: nab.activation-account.in URL: http://nab.activation-account.in/c1d583ee094744928733b2cb1192e899/login/? Protocol HTTP/1.1 Server 49.51.40.45 Beijing, China, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN), Reverse DNS Software nginx / Resource Hash `3957184650b42646dac84f7dad6edc32185c5fd63b506cf330bb19951305578d` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host nab.activation-account.in User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://nab.activation-account.in/login/index.css Connection keep-alive Cache-Control no-cache Referer http://nab.activation-account.in/login/index.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Tue, 07 Aug 2018 05:10:44 GMT Last-Modified Mon, 06 Aug 2018 12:07:55 GMT Server nginx ETag "5b683a1b-404" Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 1028
GET H/1.1	200 OK	sm_chevron_small.png /login	181 B 411 B	681ms 506ms	Image image/png	49.51.40.45 TENCENT-NET-AP-CN...
General Check archive.org Show headers Download Go to Show image Full URL http://nab.activation-account.in/login/sm_chevron_small.png Requested by Host: nab.activation-account.in URL: http://nab.activation-account.in/c1d583ee094744928733b2cb1192e899/login/? Protocol HTTP/1.1 Server 49.51.40.45 Beijing, China, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN), Reverse DNS Software nginx / Resource Hash `2124a142b37d77bcd8693cf4aeaee904e7c28b62eae43548f5bd380069302678` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host nab.activation-account.in User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://nab.activation-account.in/login/index.css Connection keep-alive Cache-Control no-cache Referer http://nab.activation-account.in/login/index.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Tue, 07 Aug 2018 05:10:44 GMT Last-Modified Mon, 06 Aug 2018 12:07:55 GMT Server nginx ETag "5b683a1b-b5" Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 181
GET H/1.1	200 OK	buttonbg.png /login	256 B 487 B	987ms 493ms	Image image/png	49.51.40.45 TENCENT-NET-AP-CN...
General Check archive.org Show headers Download Go to Show image Full URL http://nab.activation-account.in/login/buttonbg.png Requested by Host: nab.activation-account.in URL: http://nab.activation-account.in/c1d583ee094744928733b2cb1192e899/login/? Protocol HTTP/1.1 Server 49.51.40.45 Beijing, China, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN), Reverse DNS Software nginx / Resource Hash `5d4abdf7a6935ab55da9f53e5f4d169e2db66f86cb157f84a46c776d0260bf82` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host nab.activation-account.in User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://nab.activation-account.in/login/index.css Connection keep-alive Cache-Control no-cache Referer http://nab.activation-account.in/login/index.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Tue, 07 Aug 2018 05:10:44 GMT Last-Modified Mon, 06 Aug 2018 12:07:55 GMT Server nginx ETag "5b683a1b-100" Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 256
GET H/1.1	200 OK	sm_logo.png /login	5 KB 5 KB	645ms 493ms	Image image/png	49.51.40.45 TENCENT-NET-AP-CN...
General Check archive.org Show headers Download Go to Show image Full URL http://nab.activation-account.in/login/sm_logo.png Requested by Host: nab.activation-account.in URL: http://nab.activation-account.in/c1d583ee094744928733b2cb1192e899/login/? Protocol HTTP/1.1 Server 49.51.40.45 Beijing, China, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN), Reverse DNS Software nginx / Resource Hash `c8b5c36b604b175f0c6be6b98f40c5b82c05b0a76aadd383a61b0f4fe0b3d264` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host nab.activation-account.in User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://nab.activation-account.in/login/index.css Connection keep-alive Cache-Control no-cache Referer http://nab.activation-account.in/login/index.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Tue, 07 Aug 2018 05:10:44 GMT Last-Modified Mon, 06 Aug 2018 12:07:55 GMT Server nginx ETag "5b683a1b-134f" Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 4943
GET H/1.1	404 Not Found	bins.json Show response	301 B 481 B	512ms 512ms	XHR text/html	49.51.40.45 TENCENT-NET-AP-CN...
General Check archive.org Show headers Download Go to Full URL http://nab.activation-account.in/bins.json Requested by Host: nab.activation-account.in URL: http://nab.activation-account.in/bower_components/jquery/dist/jquery.min.js Protocol HTTP/1.1 Server 49.51.40.45 Beijing, China, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN), Reverse DNS Software nginx / Resource Hash `8083cb7aaaf102d56c3d8811610dd72d9af7521d0a93a6f748ebe44a7c616001` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host nab.activation-account.in User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept application/json, text/javascript, /; q=0.01 Referer http://nab.activation-account.in/c1d583ee094744928733b2cb1192e899/login/? X-Requested-With XMLHttpRequest Connection keep-alive Cache-Control no-cache Accept application/json, text/javascript, /; q=0.01 Referer http://nab.activation-account.in/c1d583ee094744928733b2cb1192e899/login/? X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Tue, 07 Aug 2018 05:10:44 GMT Content-Encoding gzip Transfer-Encoding chunked Server nginx Connection keep-alive Vary Accept-Encoding Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	token.php?link=nab_nobel&bid=nab.activation-account.in&callback=jQuery32104890781277615539_1533618643850&data=%7B%22online_bider%22%3A1%2C%22w%22%3A0%2C%22dev%22%3A0%7D&_=1533618643851 Show response 92.63.197.90/u1503fix/gates	57 B 295 B	93ms 50ms	Script application/javascript	92.63.197.90 HVFOPSERVER-AS
General Check archive.org Show headers Download Go to Full URL http://92.63.197.90/u1503fix/gates/token.php?link=nab_nobel&bid=nab.activation-account.in&callback=jQuery32104890781277615539_1533618643850&data=%7B%22online_bider%22%3A1%2C%22w%22%3A0%2C%22dev%22%3A0%7D&_=1533618643851 Requested by Host: nab.activation-account.in URL: http://nab.activation-account.in/bower_components/jquery/dist/jquery.min.js Protocol HTTP/1.1 Server 92.63.197.90 , Russian Federation, ASN60307 (HVFOPSERVER-AS, UA), Reverse DNS Software Apache/2.4.7 (Ubuntu) / PHP/5.5.9-1ubuntu4.24 Resource Hash `9f46865dccdec947841457416c289f8a258e7c0ce00e8c1e4dc0dc2f9d3f505f` Request headers Referer http://nab.activation-account.in/c1d583ee094744928733b2cb1192e899/login/? User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Tue, 07 Aug 2018 05:10:37 GMT Server Apache/2.4.7 (Ubuntu) Connection Keep-Alive X-Powered-By PHP/5.5.9-1ubuntu4.24 Content-Length 57 Keep-Alive timeout=5, max=100 Content-Type application/javascript
GET H/1.1	200 OK	token.php?link=nab_nobel&bid=nab.activation-account.in&callback=jQuery32104890781277615539_1533618643852&data=%7B%22mes%22%3A%22User%20on%20LOGIN%20page%22%7D&_=1533618643853 Show response 92.63.197.90/u1503fix/gates	57 B 295 B	98ms 53ms	Script application/javascript	92.63.197.90 HVFOPSERVER-AS
General Check archive.org Show headers Download Go to Full URL http://92.63.197.90/u1503fix/gates/token.php?link=nab_nobel&bid=nab.activation-account.in&callback=jQuery32104890781277615539_1533618643852&data=%7B%22mes%22%3A%22User%20on%20LOGIN%20page%22%7D&_=1533618643853 Requested by Host: nab.activation-account.in URL: http://nab.activation-account.in/bower_components/jquery/dist/jquery.min.js Protocol HTTP/1.1 Server 92.63.197.90 , Russian Federation, ASN60307 (HVFOPSERVER-AS, UA), Reverse DNS Software Apache/2.4.7 (Ubuntu) / PHP/5.5.9-1ubuntu4.24 Resource Hash `c7d800f731187f6eaf656544264d58cf93649da62030928ab8edea2100287320` Request headers Referer http://nab.activation-account.in/c1d583ee094744928733b2cb1192e899/login/? User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Tue, 07 Aug 2018 05:10:37 GMT Server Apache/2.4.7 (Ubuntu) Connection Keep-Alive X-Powered-By PHP/5.5.9-1ubuntu4.24 Content-Length 57 Keep-Alive timeout=5, max=100 Content-Type application/javascript
GET H/1.1	200 OK	token.php?link=nab_nobel&bid=nab.activation-account.in&callback=jQuery32104890781277615539_1533618643852&data=%7B%22online_bider%22%3A1%2C%22w%22%3A0%2C%22dev%22%3A0%7D&_=1533618643854 Show response 92.63.197.90/u1503fix/gates	57 B 294 B	51ms 50ms	Script application/javascript	92.63.197.90 HVFOPSERVER-AS
General Check archive.org Show headers Download Go to Full URL http://92.63.197.90/u1503fix/gates/token.php?link=nab_nobel&bid=nab.activation-account.in&callback=jQuery32104890781277615539_1533618643852&data=%7B%22online_bider%22%3A1%2C%22w%22%3A0%2C%22dev%22%3A0%7D&_=1533618643854 Requested by Host: nab.activation-account.in URL: http://nab.activation-account.in/bower_components/jquery/dist/jquery.min.js Protocol HTTP/1.1 Server 92.63.197.90 , Russian Federation, ASN60307 (HVFOPSERVER-AS, UA), Reverse DNS Software Apache/2.4.7 (Ubuntu) / PHP/5.5.9-1ubuntu4.24 Resource Hash `c7d800f731187f6eaf656544264d58cf93649da62030928ab8edea2100287320` Request headers Referer http://nab.activation-account.in/c1d583ee094744928733b2cb1192e899/login/? User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Tue, 07 Aug 2018 05:10:42 GMT Server Apache/2.4.7 (Ubuntu) Connection Keep-Alive X-Powered-By PHP/5.5.9-1ubuntu4.24 Content-Length 57 Keep-Alive timeout=5, max=99 Content-Type application/javascript

Redirect requests

There were HTTP redirects (301, 302) for the following requests:

Request 0

http://nab.activation-account.in/
http://nab.activation-account.in/c1d583ee094744928733b2cb1192e899?
http://nab.activation-account.in/c1d583ee094744928733b2cb1192e899/?
http://nab.activation-account.in/c1d583ee094744928733b2cb1192e899/login/?

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: NAB Bank (Banking)

30 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			nab.activation-account.in/c1d583ee094744928733b2cb1192e899	1969-12-31 23:59:59	Name: bid Value: nab.activation-account.in

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

92.63.197.90
nab.activation-account.in
49.51.40.45
92.63.197.90
183bbfa6dd97afb59cc2d8d980b832112dc448c08fa2f19308269debe756aab1
2124a142b37d77bcd8693cf4aeaee904e7c28b62eae43548f5bd380069302678
2ba3f5630fced81ab628aa477e33d59376adc39cd9af7013f4a5cbd74e7ed319
3957184650b42646dac84f7dad6edc32185c5fd63b506cf330bb19951305578d
513a520aa4672c2420d470981706bde702ad8e9190053a8eaf6a648469d48d89
5d4abdf7a6935ab55da9f53e5f4d169e2db66f86cb157f84a46c776d0260bf82
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
8083cb7aaaf102d56c3d8811610dd72d9af7521d0a93a6f748ebe44a7c616001
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
9f46865dccdec947841457416c289f8a258e7c0ce00e8c1e4dc0dc2f9d3f505f
abf125b44b7fd01a8046c83cd773b472923d00b6d4a1f5f313f50c4fd6763b56
c7d800f731187f6eaf656544264d58cf93649da62030928ab8edea2100287320
c8b5c36b604b175f0c6be6b98f40c5b82c05b0a76aadd383a61b0f4fe0b3d264
ce83ed351a7029ec1aa0a41cb2005bce51f9aced23cad3364fe2253b706e5595
eda98811a704e8f1dfe866d334073066238c53706e76034e828a14b8eefca2a5

nab.activation-account.in urlscan Pro 49.51.40.45 Malicious Activity!

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Stats

0 Requests

0 Ad-blocked

0 Malicious

0 %HTTPS

0 %IPv6

0 Domains

0 Subdomains

0 IPs

0 Countries

0 kBTransfer

0 kBSize

0 Cookies

0 Outgoing links

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect requests

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

30 JavaScript Global Variables

1 Cookies

Indicators

nab.activation-account.in
urlscan Pro

49.51.40.45 Malicious Activity!

Screenshot
Live screenshot

Full Image

0
Requests

0
Ad-blocked

0
Malicious

0 %
HTTPS

0 %
IPv6

0
Domains

0
Subdomains

0
IPs

0
Countries

0 kB
Transfer

0 kB
Size

0
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!