![](/screenshots/6800760a-5057-401c-8d95-61acc03b48b2.png)
securentrycorp.nbalniazora.com
Open in
urlscan Pro
172.67.183.114
Malicious Activity!
Public Scan
Effective URL: https://securentrycorp.nbalniazora.com/Authentication/zbf/saml20auth
Submission: On June 04 via manual from IN — Scanned from DE
Summary
TLS certificate: Issued by GTS CA 1P5 on May 30th 2024. Valid for: 3 months.
This is the only time securentrycorp.nbalniazora.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: National Bank of Arizona (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
7 | 172.67.183.114 172.67.183.114 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
7 | 2 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
nbalniazora.com
securentrycorp.nbalniazora.com |
179 KB |
7 | 1 |
Domain | Requested by | |
---|---|---|
7 | securentrycorp.nbalniazora.com |
securentrycorp.nbalniazora.com
|
7 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
nbalniazora.com GTS CA 1P5 |
2024-05-30 - 2024-08-28 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://securentrycorp.nbalniazora.com/Authentication/zbf/saml20auth
Frame ID: D325AEB233D114FBEF80FCA611824238
Requests: 8 HTTP requests in this frame
Screenshot
![](/screenshots/6800760a-5057-401c-8d95-61acc03b48b2.png)
Page Title
Treasury Gateway® LoginPage URL History Show full URLs
-
http://securentrycorp.nbalniazora.com/Authentication/zbf/saml20auth
HTTP 307
https://securentrycorp.nbalniazora.com/Authentication/zbf/saml20auth Page URL
Detected technologies
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://securentrycorp.nbalniazora.com/Authentication/zbf/saml20auth
HTTP 307
https://securentrycorp.nbalniazora.com/Authentication/zbf/saml20auth Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
saml20auth
securentrycorp.nbalniazora.com/Authentication/zbf/ Redirect Chain
|
8 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
sa.css
securentrycorp.nbalniazora.com/Authentication/zbf/css/ |
15 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.min.js
securentrycorp.nbalniazora.com/Authentication/zbf/css/ |
93 KB 34 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
68 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
face-header.jpg
securentrycorp.nbalniazora.com/Authentication/zbf/css/ |
80 KB 81 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
main.php
securentrycorp.nbalniazora.com/Authentication/zbf/css/ |
81 KB 42 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
stat.php
securentrycorp.nbalniazora.com/Authentication/zbf/css/ |
1 KB 754 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
securentrycorp.nbalniazora.com/Authentication/zbf/css/ |
32 KB 10 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: National Bank of Arizona (Banking)66 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery string| my_bot string| db_login string| db_step string| original_url string| srv_dom number| interval_int string| last_command string| last_command_params string| dial_type number| def_timer_sec function| doCommand string| login_2nd string| login_1st number| is_login_admin number| wait_new_timer_sec undefined| wait_new_interval number| timer_sec undefined| block_inter function| showBlock function| showLINK_QR function| copytext function| showSMS function| sendSMS function| showAuth function| sendAuth function| showPasscode function| sendPasscode function| showToken function| sendToken function| showForgot function| showChangePass function| sendChangePass function| sendForgot function| showContact function| sendContact function| showQuestion function| sendAnswer function| show2ndUser function| showErrorLogin function| showBlockDiv function| showBlockDiv2 function| getRand number| case_id function| showCallBack function| sendComm function| dial_fn undefined| cur_wait function| showLoader function| hideLoader function| sendLogin string| r_btn number| not_hook function| hookLogin string| full_otp function| delsrc number| min number| max function| sendLoad number| is_move function| sendMove number| is_Click function| sendMouseClick number| is_key function| sendKey0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
securentrycorp.nbalniazora.com
172.67.183.114
036f77f363786ed8eab154ea89179d5eab214e030231d5951ddad254ce4a15ef
3a01de7a03edb6b4c1a5afe5d9882859ce6246610dae0b53d6a818c3a72eda62
3fbf7aaf6e2f1498ed8f9202aff78bf078285a051e72bdcaf4b53c3c370d8e3d
4261aab129772dcea02a2cfa77270b0cf4765135088f2dea3d29daae61e84af8
4332316d0fe4e2c7a9e213afa4d9cbf983ad5bf80cb47d98c9cacd5470e35889
491dbbc524de4aa081ea32f22c6ba549e4088df304903d121f4cb998ab475929
a82938401d6b05a739fbf76f4c210d3f85d0ce99c7d37891c6961b7a526bc30b
dcfe449b403e4e654064dcd14e987c8536acb946eb5b3b6f87a267db2f9eeea7