www.santander.co.uk-restore.live Open in urlscan Pro
185.61.152.34 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.santander.co.uk-restore.live/
Effective URL:
https://www.santander.co.uk-restore.live/captcha.php
Submission: On December 01 via automatic, source certstream-suspicious (December 1st 2021, 6:35:42 pm UTC) — Scanned from GB

Summary HTTP 16 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 16 HTTP transactions. The main IP is 185.61.152.34, located in United Kingdom and belongs to NAMECHEAP-NET, US. The main domain is www.santander.co.uk-restore.live.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on May 7th 2020. Valid for: 2 years.

This is the only time www.santander.co.uk-restore.live was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Santander (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 16	185.61.152.34 185.61.152.34	22612 (NAMECHEAP...) (NAMECHEAP-NET)
1	188.40.246.96 188.40.246.96	24940 (HETZNER-AS) (HETZNER-AS)
16	2

16 185.61.152.34 (United Kingdom) 1 redirects

ASN22612 (NAMECHEAP-NET, US)
PTR: server132-2.web-hosting.com

www.santander.co.uk-restore.live	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 188.40.246.96 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.96.246.40.188.clients.your-server.de

remote.captcha.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
16	uk-restore.live 1 redirects www.santander.co.uk-restore.live	376 KB
1	captcha.com remote.captcha.com	633 B
16	2

	Domain	Requested by
16	www.santander.co.uk-restore.live	1 redirects www.santander.co.uk-restore.live
1	remote.captcha.com	www.santander.co.uk-restore.live
16	2

This site contains links to these domains. Also see Links.

Domain
captcha.org

Subject Issuer	Validity	Valid
*.web-hosting.com Sectigo RSA Domain Validation Secure Server CA	`2020-05-07` - `2022-04-05`	2 years	crt.sh
remote.captcha.com R3	`2021-10-10` - `2022-01-08`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.santander.co.uk-restore.live/captcha.php
Frame ID: FB31343F8517A8337CE27C621A3F668C
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Personal Online Banking: Log on or sign up

Page URL History Show full URLs

https://www.santander.co.uk-restore.live/ HTTP 302
https://www.santander.co.uk-restore.live/captcha.php Page URL

Page Statistics

16
Requests

6 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

377 kB
Transfer

568 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://captcha.org/captcha.html?php
Title: What is BotDetect PHP CAPTCHA Validation?

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.santander.co.uk-restore.live/ HTTP 302
https://www.santander.co.uk-restore.live/captcha.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request captcha.php Show response www.santander.co.uk-restore.live/ Redirect Chain https://www.santander.co.uk-restore.live/ https://www.santander.co.uk-restore.live/captcha.php	20 KB 5 KB	42ms 41ms	Document text/html	185.61.152.34 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://www.santander.co.uk-restore.live/captcha.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.61.152.34 , United Kingdom, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server132-2.web-hosting.com Software LiteSpeed / PHP/7.2.34 Resource Hash `910a990c703831505e5d95130762cf88b04b582b07e406d95fe60a57de3ea689` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language en-GB,en;q=0.9 Response headers x-powered-by PHP/7.2.34 expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate pragma no-cache content-type text/html; charset=UTF-8 content-encoding br vary Accept-Encoding date Wed, 01 Dec 2021 18:35:38 GMT server LiteSpeed x-turbo-charged-by LiteSpeed Redirect headers x-powered-by PHP/7.2.34 expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-cache, no-store, must-revalidate, max-age=0 pragma no-cache location captcha.php content-type text/html; charset=UTF-8 content-encoding br vary Accept-Encoding date Wed, 01 Dec 2021 18:35:38 GMT server LiteSpeed x-turbo-charged-by LiteSpeed
GET H2	200	bdc-layout-stylesheet.css www.santander.co.uk-restore.live/botdetect/public/	4 KB 937 B	71ms 71ms	Stylesheet text/css	185.61.152.34 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://www.santander.co.uk-restore.live/botdetect/public/bdc-layout-stylesheet.css?t=1638383738 Requested by Host: www.santander.co.uk-restore.live URL: https://www.santander.co.uk-restore.live/captcha.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.61.152.34 , United Kingdom, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server132-2.web-hosting.com Software LiteSpeed / Resource Hash `26502ecad502d81b20a0f6ac7f5724f8711f5e26fd7589a73d1cd155b97a878c` Request headers Accept-Language en-GB,en;q=0.9 Referer https://www.santander.co.uk-restore.live/captcha.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 18:35:38 GMT content-encoding br last-modified Mon, 22 Jul 2019 22:47:44 GMT server LiteSpeed vary Accept-Encoding content-type text/css cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 717 expires Wed, 08 Dec 2021 18:35:38 GMT
GET H2	200	styles.css www.santander.co.uk-restore.live/assets/css/	181 KB 26 KB	40ms 40ms	Stylesheet text/css	185.61.152.34 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://www.santander.co.uk-restore.live/assets/css/styles.css Requested by Host: www.santander.co.uk-restore.live URL: https://www.santander.co.uk-restore.live/captcha.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.61.152.34 , United Kingdom, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server132-2.web-hosting.com Software LiteSpeed / Resource Hash `cb84575e7d02ca7ba09f08e3c6481aca4664f5d708793178db0ff9ddf6528c23` Request headers Accept-Language en-GB,en;q=0.9 Referer https://www.santander.co.uk-restore.live/captcha.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 18:35:38 GMT content-encoding br last-modified Tue, 11 Aug 2020 04:50:40 GMT server LiteSpeed vary Accept-Encoding content-type text/css cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 26815 expires Wed, 08 Dec 2021 18:35:38 GMT
GET H2	200	header-logo.png www.santander.co.uk-restore.live/assets/images/	3 KB 3 KB	70ms 68ms	Image image/png	185.61.152.34 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://www.santander.co.uk-restore.live/assets/images/header-logo.png Requested by Host: www.santander.co.uk-restore.live URL: https://www.santander.co.uk-restore.live/captcha.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.61.152.34 , United Kingdom, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server132-2.web-hosting.com Software LiteSpeed / Resource Hash `f700c3638638b62b07e614c8cae5665cf4bfa956452ab4e6fea5a15965fc40f7` Request headers Accept-Language en-GB,en;q=0.9 Referer https://www.santander.co.uk-restore.live/captcha.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 18:35:38 GMT last-modified Tue, 11 Aug 2020 04:50:40 GMT server LiteSpeed content-type image/png cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 2795 expires Wed, 08 Dec 2021 18:35:38 GMT
GET H2	200	warning.png www.santander.co.uk-restore.live/assets/images/	7 KB 7 KB	87ms 85ms	Image image/png	185.61.152.34 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://www.santander.co.uk-restore.live/assets/images/warning.png Requested by Host: www.santander.co.uk-restore.live URL: https://www.santander.co.uk-restore.live/captcha.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.61.152.34 , United Kingdom, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server132-2.web-hosting.com Software LiteSpeed / Resource Hash `e0447b040f0a5509262929f5a15c664c6eb2502cf91ce51e0856e33ab380108b` Request headers Accept-Language en-GB,en;q=0.9 Referer https://www.santander.co.uk-restore.live/captcha.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 18:35:38 GMT last-modified Tue, 03 Nov 2020 23:36:50 GMT server LiteSpeed content-type image/png cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 7319 expires Wed, 08 Dec 2021 18:35:38 GMT
GET H2	200	botdetect.php www.santander.co.uk-restore.live/	5 KB 5 KB	104ms 102ms	Image image/jpeg	185.61.152.34 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://www.santander.co.uk-restore.live/botdetect.php?get=image&c=ExampleCaptcha&t=e5fe9b7ab51ac356fa1e73000d746f64 Requested by Host: www.santander.co.uk-restore.live URL: https://www.santander.co.uk-restore.live/captcha.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.61.152.34 , United Kingdom, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server132-2.web-hosting.com Software LiteSpeed / PHP/7.2.34 Resource Hash `b02d9066f1c3933941f160b52a9b57c228f7309b160911a51182f678e7f5b3bf` Request headers Accept-Language en-GB,en;q=0.9 Referer https://www.santander.co.uk-restore.live/captcha.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Wed, 01 Dec 2021 18:35:38 GMT server LiteSpeed x-powered-by PHP/7.2.34 content-type image/jpeg cache-control no-cache, no-store, must-revalidate x-turbo-charged-by LiteSpeed accept-ranges none x-robots-tag noindex, nofollow, noarchive, nosnippet content-length 4779 expires -1
GET H2	200	bdc-reload-icon.gif www.santander.co.uk-restore.live/botdetect/public/	1 KB 1 KB	86ms 85ms	Image image/gif	185.61.152.34 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://www.santander.co.uk-restore.live/botdetect/public/bdc-reload-icon.gif Requested by Host: www.santander.co.uk-restore.live URL: https://www.santander.co.uk-restore.live/captcha.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.61.152.34 , United Kingdom, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server132-2.web-hosting.com Software LiteSpeed / Resource Hash `7106a845473c9df48f3c2d4737f9cb2804310aec8cf1b35bbd15551a3a05bf4e` Request headers Accept-Language en-GB,en;q=0.9 Referer https://www.santander.co.uk-restore.live/captcha.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 18:35:38 GMT last-modified Mon, 22 Jul 2019 22:47:44 GMT server LiteSpeed content-type image/gif cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 1170 expires Wed, 08 Dec 2021 18:35:38 GMT
GET H2	200	bdc-sound-icon.gif www.santander.co.uk-restore.live/botdetect/public/	1 KB 1 KB	71ms 70ms	Image image/gif	185.61.152.34 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://www.santander.co.uk-restore.live/botdetect/public/bdc-sound-icon.gif Requested by Host: www.santander.co.uk-restore.live URL: https://www.santander.co.uk-restore.live/captcha.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.61.152.34 , United Kingdom, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server132-2.web-hosting.com Software LiteSpeed / Resource Hash `f34a3b7a468fe25416791a63831cf9ed92a2985b57c5f5bb4ad30dd7d873b852` Request headers Accept-Language en-GB,en;q=0.9 Referer https://www.santander.co.uk-restore.live/captcha.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 18:35:38 GMT last-modified Mon, 22 Jul 2019 22:47:44 GMT server LiteSpeed content-type image/gif cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 1191 expires Wed, 08 Dec 2021 18:35:38 GMT
GET H2	200	botdetect.php Show response www.santander.co.uk-restore.live/	29 KB 9 KB	211ms 209ms	Script text/javascript	185.61.152.34 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://www.santander.co.uk-restore.live/botdetect.php?get=script-include&c=ExampleCaptcha&t=e5fe9b7ab51ac356fa1e73000d746f64 Requested by Host: www.santander.co.uk-restore.live URL: https://www.santander.co.uk-restore.live/captcha.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.61.152.34 , United Kingdom, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server132-2.web-hosting.com Software LiteSpeed / PHP/7.2.34 Resource Hash `9220f8857a4056089b64131a9a27247be112f0d51a2c103d777bf11ba7abe859` Request headers Accept-Language en-GB,en;q=0.9 Referer https://www.santander.co.uk-restore.live/captcha.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers pragma no-cache date Wed, 01 Dec 2021 18:35:38 GMT content-encoding br server LiteSpeed x-powered-by PHP/7.2.34 vary Accept-Encoding content-type text/javascript;charset=UTF-8 cache-control no-store, no-cache, must-revalidate x-turbo-charged-by LiteSpeed x-robots-tag noindex, nofollow, noarchive, nosnippet expires Thu, 19 Nov 1981 08:52:00 GMT
GET H2	200	asset-3-3-x.png www.santander.co.uk-restore.live/assets/images/	35 KB 35 KB	72ms 71ms	Image image/png	185.61.152.34 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://www.santander.co.uk-restore.live/assets/images/asset-3-3-x.png Requested by Host: www.santander.co.uk-restore.live URL: https://www.santander.co.uk-restore.live/captcha.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.61.152.34 , United Kingdom, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server132-2.web-hosting.com Software LiteSpeed / Resource Hash `3a1b7863c59caf1cb8c5e14792598b1504b15072ed91aac22d7b45e06e924c02` Request headers Accept-Language en-GB,en;q=0.9 Referer https://www.santander.co.uk-restore.live/captcha.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 18:35:38 GMT last-modified Tue, 11 Aug 2020 04:50:40 GMT server LiteSpeed content-type image/png cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 35352 expires Wed, 08 Dec 2021 18:35:38 GMT
GET H2	200	asset-2.png www.santander.co.uk-restore.live/assets/images/	3 KB 4 KB	84ms 83ms	Image image/png	185.61.152.34 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://www.santander.co.uk-restore.live/assets/images/asset-2.png Requested by Host: www.santander.co.uk-restore.live URL: https://www.santander.co.uk-restore.live/captcha.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.61.152.34 , United Kingdom, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server132-2.web-hosting.com Software LiteSpeed / Resource Hash `1bca034dc76dab33232d41f7f9705fced08c4b48c90e23bd737e4b610d1b6df8` Request headers Accept-Language en-GB,en;q=0.9 Referer https://www.santander.co.uk-restore.live/captcha.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 18:35:38 GMT last-modified Tue, 11 Aug 2020 04:50:40 GMT server LiteSpeed content-type image/png cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 3569 expires Wed, 08 Dec 2021 18:35:38 GMT
GET H2	200	SantanderTextW05-Regular.77501c6e88280139f847.ttf www.santander.co.uk-restore.live/assets/fonts/	138 KB 138 KB	33ms 33ms	Font font/ttf	185.61.152.34 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://www.santander.co.uk-restore.live/assets/fonts/SantanderTextW05-Regular.77501c6e88280139f847.ttf Requested by Host: www.santander.co.uk-restore.live URL: https://www.santander.co.uk-restore.live/assets/css/styles.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.61.152.34 , United Kingdom, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server132-2.web-hosting.com Software LiteSpeed / Resource Hash `3c34b516dc489a5ff3cb121a73b6cfc25ec0920394b2d3b742d30201e71e6e24` Request headers Referer https://www.santander.co.uk-restore.live/assets/css/styles.css Origin https://www.santander.co.uk-restore.live Accept-Language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 18:35:38 GMT last-modified Tue, 11 Aug 2020 04:50:40 GMT server LiteSpeed content-type font/ttf cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 141192 expires Wed, 08 Dec 2021 18:35:38 GMT
GET H2	200	include.js Show response remote.captcha.com/	1 KB 633 B	147ms 46ms	Script application/javascript	188.40.246.96 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://remote.captcha.com/include.js?i=BkKQv7pKnslM17FvWOIRGbUxJFnyjPtXZ3IztkW_LNOjDSD-gd_BGqo7tyXjp98QjPYjovUIjGGLPp6UyQlybIEc4GX7_btEOCZRIRMaqxNvVfGdYThOdBQHOOpsLTDv5V2Wx_X3R4ZwzxsLBJIg0TfgySHbfvTsEJfn3EYT8_GTd_S9lK07juwyqKerI--OLONvLpBNSSks5RHLzlnSN5wn4YPjE3uVaKVnnmrZH7jdbGEzCnvnzifKrcc Requested by Host: www.santander.co.uk-restore.live URL: https://www.santander.co.uk-restore.live/botdetect.php?get=script-include&c=ExampleCaptcha&t=e5fe9b7ab51ac356fa1e73000d746f64 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 188.40.246.96 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.96.246.40.188.clients.your-server.de Software Apache/2.4.38 (Debian) / Resource Hash `eac0ec918cd74c051f4c5c83cdfe60c12a3bf2fd44a0472661fafab04777e9f9` Request headers Accept-Language en-GB,en;q=0.9 Referer https://www.santander.co.uk-restore.live/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 18:35:38 GMT content-encoding gzip last-modified Sun, 14 Aug 2016 07:44:41 GMT server Apache/2.4.38 (Debian) etag "416-53a0349d706b8-gzip" vary Accept-Encoding content-type application/javascript x-robots-tag noindex, noarchive, nosnippet, noimageindex, noodp, nofollow content-length 424
GET H2	200	bdc-reload-disabled-icon.gif www.santander.co.uk-restore.live/botdetect/public/	1 KB 1 KB	34ms 33ms	Image image/gif	185.61.152.34 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://www.santander.co.uk-restore.live/botdetect/public/bdc-reload-disabled-icon.gif Requested by Host: www.santander.co.uk-restore.live URL: https://www.santander.co.uk-restore.live/captcha.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.61.152.34 , United Kingdom, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server132-2.web-hosting.com Software LiteSpeed / Resource Hash `96aa0e2304d5f823defce8f2ee99eddf59cab3a49159b7b7470886d468b66ac1` Request headers Accept-Language en-GB,en;q=0.9 Referer https://www.santander.co.uk-restore.live/captcha.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 18:35:38 GMT last-modified Mon, 22 Jul 2019 22:47:44 GMT server LiteSpeed content-type image/gif cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 1083 expires Wed, 08 Dec 2021 18:35:38 GMT
GET H2	200	bdc-sound-disabled-icon.gif www.santander.co.uk-restore.live/botdetect/public/	1 KB 1 KB	34ms 33ms	Image image/gif	185.61.152.34 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://www.santander.co.uk-restore.live/botdetect/public/bdc-sound-disabled-icon.gif Requested by Host: www.santander.co.uk-restore.live URL: https://www.santander.co.uk-restore.live/captcha.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.61.152.34 , United Kingdom, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server132-2.web-hosting.com Software LiteSpeed / Resource Hash `f3bdd2185c191359c53405a2108eea8ed242f94b9e87832a23ff703e809f2915` Request headers Accept-Language en-GB,en;q=0.9 Referer https://www.santander.co.uk-restore.live/captcha.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 18:35:38 GMT last-modified Mon, 22 Jul 2019 22:47:44 GMT server LiteSpeed content-type image/gif cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 1071 expires Wed, 08 Dec 2021 18:35:38 GMT
GET H2	200	SantanderHeadlineW05-Rg.838addf7f1e08ecb31f9.ttf www.santander.co.uk-restore.live/assets/fonts/	138 KB 138 KB	33ms 32ms	Font font/ttf	185.61.152.34 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://www.santander.co.uk-restore.live/assets/fonts/SantanderHeadlineW05-Rg.838addf7f1e08ecb31f9.ttf Requested by Host: www.santander.co.uk-restore.live URL: https://www.santander.co.uk-restore.live/assets/css/styles.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.61.152.34 , United Kingdom, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server132-2.web-hosting.com Software LiteSpeed / Resource Hash `cf2166ed0037c6f2797c0774063ecc0275cd08473aeff74cf79dc510bb60398b` Request headers Referer https://www.santander.co.uk-restore.live/assets/css/styles.css Origin https://www.santander.co.uk-restore.live Accept-Language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 01 Dec 2021 18:35:38 GMT last-modified Tue, 11 Aug 2020 04:50:40 GMT server LiteSpeed content-type font/ttf cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 141148 expires Wed, 08 Dec 2021 18:35:38 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Santander (Banking)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.santander.co.uk-restore.live/	1969-12-31 23:59:59	Name: PHPSESSID Value: ee2734fabde781dcc6d6e5652339af86

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

remote.captcha.com
www.santander.co.uk-restore.live
185.61.152.34
188.40.246.96
1bca034dc76dab33232d41f7f9705fced08c4b48c90e23bd737e4b610d1b6df8
26502ecad502d81b20a0f6ac7f5724f8711f5e26fd7589a73d1cd155b97a878c
3a1b7863c59caf1cb8c5e14792598b1504b15072ed91aac22d7b45e06e924c02
3c34b516dc489a5ff3cb121a73b6cfc25ec0920394b2d3b742d30201e71e6e24
7106a845473c9df48f3c2d4737f9cb2804310aec8cf1b35bbd15551a3a05bf4e
910a990c703831505e5d95130762cf88b04b582b07e406d95fe60a57de3ea689
9220f8857a4056089b64131a9a27247be112f0d51a2c103d777bf11ba7abe859
96aa0e2304d5f823defce8f2ee99eddf59cab3a49159b7b7470886d468b66ac1
b02d9066f1c3933941f160b52a9b57c228f7309b160911a51182f678e7f5b3bf
cb84575e7d02ca7ba09f08e3c6481aca4664f5d708793178db0ff9ddf6528c23
cf2166ed0037c6f2797c0774063ecc0275cd08473aeff74cf79dc510bb60398b
e0447b040f0a5509262929f5a15c664c6eb2502cf91ce51e0856e33ab380108b
eac0ec918cd74c051f4c5c83cdfe60c12a3bf2fd44a0472661fafab04777e9f9
f34a3b7a468fe25416791a63831cf9ed92a2985b57c5f5bb4ad30dd7d873b852
f3bdd2185c191359c53405a2108eea8ed242f94b9e87832a23ff703e809f2915
f700c3638638b62b07e614c8cae5665cf4bfa956452ab4e6fea5a15965fc40f7

www.santander.co.uk-restore.live Open in urlscan Pro 185.61.152.34 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

16 Requests

6 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

377 kBTransfer

568 kBSize

1 Cookies

1 Outgoing links

Page URL History

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

10 JavaScript Global Variables

1 Cookies

Indicators

www.santander.co.uk-restore.live Open in urlscan Pro
185.61.152.34 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

6 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

377 kB
Transfer

568 kB
Size

1
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!