www.security-natwest.co.uk
Open in
urlscan Pro
178.159.36.185
Malicious Activity!
Public Scan
Submitted URL: http://www.security-natwest.co.uk/
Effective URL: http://www.security-natwest.co.uk/Login.php?sslchannel=true&sessionid=GdtptNOrq1xFmsLJwlYuZ9dBObcIgcIWpblTZakqbS5ykQiRcgmbpzNdLZV1...
Submission: On February 26 via manual from GB
Effective URL: http://www.security-natwest.co.uk/Login.php?sslchannel=true&sessionid=GdtptNOrq1xFmsLJwlYuZ9dBObcIgcIWpblTZakqbS5ykQiRcgmbpzNdLZV1...
Submission: On February 26 via manual from GB
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 15 HTTP transactions.
The main IP is 178.159.36.185, located in
Russian Federation and
belongs to AS-MAROSNET Moscow, Russia, RU.
The main domain is www.security-natwest.co.uk.
This is the only time www.security-natwest.co.uk was scanned on urlscan.io!
This is the only time www.security-natwest.co.uk was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: NatWest (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 15 | 178.159.36.185 178.159.36.185 | 48666 (AS-MAROSN...) (AS-MAROSNET Moscow) | |
| 15 | 1 |
15
178.159.36.185
(Russian Federation)
ASN48666 (AS-MAROSNET Moscow, Russia, RU)
PTR: server.dnsfreedom.net
ASN48666 (AS-MAROSNET Moscow, Russia, RU)
PTR: server.dnsfreedom.net
| www.security-natwest.co.uk |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 15 |
security-natwest.co.uk
www.security-natwest.co.uk |
178 KB |
| 15 | 1 |
| Domain | Requested by | |
|---|---|---|
| 15 | www.security-natwest.co.uk |
www.security-natwest.co.uk
|
| 15 | 1 |
This site contains no links.
| Subject Issuer | Validity | Valid |
|---|
This page contains 1 frames:
Primary Page:
http://www.security-natwest.co.uk/Login.php?sslchannel=true&sessionid=GdtptNOrq1xFmsLJwlYuZ9dBObcIgcIWpblTZakqbS5ykQiRcgmbpzNdLZV1bEXBPjuPtPfFIke3bwUo
Frame ID: (1FA7703F15FF6C7831AC0C87FF42658C)
Requests: 15 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- http://www.security-natwest.co.uk/ Page URL
- http://www.security-natwest.co.uk/Login.php?sslchannel=true&sessionid=GdtptNOrq1xFmsLJwlYuZ9dBObcIgcIWpblTZakq... Page URL
Detected technologies
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://www.security-natwest.co.uk/ Page URL
- http://www.security-natwest.co.uk/Login.php?sslchannel=true&sessionid=GdtptNOrq1xFmsLJwlYuZ9dBObcIgcIWpblTZakqbS5ykQiRcgmbpzNdLZV1bEXBPjuPtPfFIke3bwUo Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
 Cookie set
/
www.security-natwest.co.uk/ |
204 B 605 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Primary Request
Login.php
www.security-natwest.co.uk/ |
10 KB 10 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
enc.js
www.security-natwest.co.uk/assets/js/ |
8 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
buns.css
www.security-natwest.co.uk/assets/css/ |
69 KB 69 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
three.css
www.security-natwest.co.uk/assets/css/ |
25 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
flgo.png
www.security-natwest.co.uk/assets/img/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
fg65.gif
www.security-natwest.co.uk/assets/img/ |
1 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
sdfd33.gif
www.security-natwest.co.uk/assets/img/ |
2 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
error.gif
www.security-natwest.co.uk/assets/img/ |
111 B 352 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
def.gif
www.security-natwest.co.uk/assets/img/ |
6 KB 7 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
reg.woff
www.security-natwest.co.uk/assets/fonts/ |
22 KB 22 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bol.woff
www.security-natwest.co.uk/assets/fonts/ |
23 KB 23 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
topLine.gif
www.security-natwest.co.uk/assets/img/ |
915 B 1 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
arr.gif
www.security-natwest.co.uk/assets/img/ |
53 B 293 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
footer-bg.png
www.security-natwest.co.uk/assets/img/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: NatWest (Banking)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| Aes object| Base64 object| Utf8 string| hea2p string| hea2t string| output string| ctrTxt1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| www.security-natwest.co.uk/ | Name: PHPSESSID Value: 7at2ck94tq14rs5djeqb7phe97 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
www.security-natwest.co.uk
178.159.36.185
0fce4795c07caeffdb196345e3b48ed717d6c77af2d89efefc31db8d8f11b695
23d5df83d5a429e895043a5ce3b11b682e3d0b182d1032b89b0596de272f1a7e
2ee011274db7eec8491dad6a8f2c3ffc9e8f66434921864f05fbbb518e23268e
34a696b824cb72b7bcbba9eca5d95f67292b7489c3ccd4b9c19dfd36c63c6793
48827d7cb1ec7b7d7eacf3d9a8285aa25a006511a29da0223da8b919b903042b
5537b6655bb201f9e64ed63fd16727ed029077a6022ac5117ffcbf923f9e2264
6369118b817a8a0549092cce8b77d77ac7ec88cc76a66d3ed9e32e9c4f6fb23f
682df64974058b47f875e3e8c904ad1b28325a9b37e30b0735b7bd057b61be9a
917942589e5b140755ee83bb4720ca9c1bbf7705f44f51a78ba1ffa635420c50
ac05e8bc4069bf64beb3de9aa9ba4becb4b44f419e89953f185e1b016fa3b9d3
c155bab1044d8cd188c87e0c361471462e964d5672939c9f91d83562a828f919
dbc1cad17ed91a5684d115f609df37622969737bc3a0db64c7e8b8c20b994e30
e4a1b9628a61642629299077aa8074e3ee6b280d397efa0d7220c7b09efe8522
faec2bd1524ea1127fb1a6fa6f9cc3af135442f296c125851d9d2398c7d1368a
fc99f76b545563e899aff7975a142cb9362138650975bbd782ea25daaf6bd3c1