online.internetbanka_citadele.naturalbornpainters.com

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 5 HTTP transactions. The main IP is 18.232.129.21, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is online.internetbanka_citadele.naturalbornpainters.com.

This is the only time online.internetbanka_citadele.naturalbornpainters.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banka Citadele (Banking)

Domain & IP information

	IP Address		AS Autonomous System
1	18.232.129.21 18.232.129.21		14618 (AMAZON-AES) (AMAZON-AES)
5	2

1 18.232.129.21 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-232-129-21.compute-1.amazonaws.com

online.internetbanka_citadele.naturalbornpainters.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	naturalbornpainters.com online.internetbanka_citadele.naturalbornpainters.com	475 KB
5	1

	Domain	Requested by
1	online.internetbanka_citadele.naturalbornpainters.com
5	1

This site contains links to these domains. Also see Links.

Domain
online.citadele.lv
www.citadele.lv

Subject Issuer	Validity	Valid

This page contains 2 frames:

Primary Page: http://online.internetbanka_citadele.naturalbornpainters.com/ibbf/Citadele.internetbanka.php?lv_lv?s=&r=
Frame ID: D7193BD8079D9F360576D36B5569B4DB
Requests: 6 HTTP requests in this frame

Frame: data://truncated
Frame ID: 8B3C11F2A68413D5642DECBE26815A45
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Citadele internetbanka

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

5
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

643 kB
Transfer

652 kB
Size

0
Cookies

8 Outgoing links

These are links going to different origins than the main page.

URL: https://online.citadele.lv/ibbf/ru_lv?loginType=codecard_calculator
Title: RU

Search URL Search Domain Scan URL

URL: https://online.citadele.lv/ibbf/en_lv?loginType=codecard_calculator
Title: EN

Search URL Search Domain Scan URL

URL: https://online.citadele.lv/ibbf/lv_lv

Search URL Search Domain Scan URL

URL: https://online.citadele.lv/ibbf/lv_lv?loginType=codecard_calculator&f=1
Title: Aizmirsāt paroli?

Search URL Search Domain Scan URL

URL: https://online.citadele.lv/ibhelp/login_lv_lv.htm
Title: Palīdzība

Search URL Search Domain Scan URL

URL: https://www.citadele.lv/lv/support/online-banking/
Title: Informācija par Internetbanku

Search URL Search Domain Scan URL

URL: https://online.citadele.lv/ibhelp/security_lv_lv.htm
Title: Internetbankas droša lietošana

Search URL Search Domain Scan URL

URL: https://www.citadele.lv/lv/
Title: www.citadele.lv

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Citadele.internetbanka.php Show response online.internetbanka_citadele.naturalbornpainters.com/ibbf/	474 KB 475 KB	793ms 118ms	Document text/html	18.232.129.21 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL http://online.internetbanka_citadele.naturalbornpainters.com/ibbf/Citadele.internetbanka.php?lv_lv?s=&r= Protocol HTTP/1.1 Server 18.232.129.21 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-232-129-21.compute-1.amazonaws.com Software Microsoft-IIS/10.0 / PHP/5.6.31 Resource Hash `13fd62d756b9664625f44592ba89493b4fc7ef70a8249b947136e8b7f54c7b98` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Content-Length 485734 Content-Type text/html; charset=UTF-8 Date Thu, 01 Dec 2022 13:32:11 GMT Server Microsoft-IIS/10.0 X-Powered-By PHP/5.6.31
GET DATA	200 OK	truncated /	8 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `f6ea8147a796c7dd400044088cd0f3f9802f2e59df4640ac47c90124468be062` Request headers accept-language de-DE,de;q=0.9 Referer http://online.internetbanka_citadele.naturalbornpainters.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	38 KB 38 KB		Font application/x-font-otf
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `f7a392ec9263fb7c4723cd2b3dd727ecb7abb08080d737fb51d5e2ba59a49e3d` Request headers Referer http://online.internetbanka_citadele.naturalbornpainters.com/ Origin http://online.internetbanka_citadele.naturalbornpainters.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36 Response headers Content-Type application/x-font-otf
GET DATA	200 OK	truncated /	37 KB 37 KB		Font application/font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `e8eea96e29a7c0a72612ab85ca3229979666467a28349642c2176e7189a1a39c` Request headers Referer http://online.internetbanka_citadele.naturalbornpainters.com/ Origin http://online.internetbanka_citadele.naturalbornpainters.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36 Response headers Content-Type application/font-woff
GET DATA	200 OK	truncated /	39 KB 39 KB		Font application/x-font-otf
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `c3ccd8bd926647c99b4bb5436ed01b330f633d1464b50d189e4a5367751d6055` Request headers Referer http://online.internetbanka_citadele.naturalbornpainters.com/ Origin http://online.internetbanka_citadele.naturalbornpainters.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36 Response headers Content-Type application/x-font-otf
GET DATA	200 OK	truncated /	39 KB 39 KB		Font application/x-font-otf
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `d51609cb4e7b43c4383b62590a77afde105e6320a448d0473fb647531bd62582` Request headers Referer http://online.internetbanka_citadele.naturalbornpainters.com/ Origin http://online.internetbanka_citadele.naturalbornpainters.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36 Response headers Content-Type application/x-font-otf
GET DATA	200 OK	truncated / Frame 8B3C	81 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743` Request headers accept-language de-DE,de;q=0.9 Referer http://online.internetbanka_citadele.naturalbornpainters.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36 Response headers Content-Type image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banka Citadele (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| oncontentvisibilityautostatechange function| savepage_ShadowLoader

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

online.internetbanka_citadele.naturalbornpainters.com
18.232.129.21
044f2944f2667ddc30f531b61a4ab559e9321bb6610faa05137b729d7c21d758
0995f15d4323490ac0d3c7e4f530b3ba31a586dbd48717faaeaba78008a3052b
13fd62d756b9664625f44592ba89493b4fc7ef70a8249b947136e8b7f54c7b98
6dd66cb33d3bf9f2d42103513cb5c81d9ce4d56618c4d2ca87cc72584afcb5dd
7424f30af393e0d17ec8d2e61331b7afebb9b273f912d32043adbe91885b10c3
95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743
c3ccd8bd926647c99b4bb5436ed01b330f633d1464b50d189e4a5367751d6055
d51609cb4e7b43c4383b62590a77afde105e6320a448d0473fb647531bd62582
e8eea96e29a7c0a72612ab85ca3229979666467a28349642c2176e7189a1a39c
f6ea8147a796c7dd400044088cd0f3f9802f2e59df4640ac47c90124468be062
f7a392ec9263fb7c4723cd2b3dd727ecb7abb08080d737fb51d5e2ba59a49e3d

online.internetbanka_citadele.naturalbornpainters.com Open in urlscan Pro 18.232.129.21 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

5 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

643 kBTransfer

652 kBSize

0 Cookies

8 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

Indicators

online.internetbanka_citadele.naturalbornpainters.com Open in urlscan Pro
18.232.129.21 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

643 kB
Transfer

652 kB
Size

0
Cookies

5 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!