![](/screenshots/8a73fda8-ff70-429c-aac5-9cd817cdba3a.png)
www.cafesanmartin.com.ni
Open in
urlscan Pro
186.1.56.74
Malicious Activity!
Public Scan
Effective URL: https://www.cafesanmartin.com.ni/wp-content/ntw/natwest3/mobile/login.php?&sessionid=6453fde7ccad82c18ee4a46374c8f339&securessl=true
Submission: On June 10 via api from US — Scanned from DE
Summary
TLS certificate: Issued by R3 on May 9th 2024. Valid for: 3 months.
This is the only time www.cafesanmartin.com.ni was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: NatWest (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 29 | 186.1.56.74 186.1.56.74 | 18840 (EQUIPOS Y...) (EQUIPOS Y SISTEMAS S.A.) | |
28 | 1 |
ASN18840 (EQUIPOS Y SISTEMAS S.A., NI)
PTR: static-186-1-56-74.ideay.life
www.cafesanmartin.com.ni |
Apex Domain Subdomains |
Transfer | |
---|---|---|
29 |
cafesanmartin.com.ni
1 redirects
www.cafesanmartin.com.ni |
447 KB |
28 | 1 |
Domain | Requested by | |
---|---|---|
29 | www.cafesanmartin.com.ni |
1 redirects
www.cafesanmartin.com.ni
|
28 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.cafesanmartin.com.ni R3 |
2024-05-09 - 2024-08-07 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://www.cafesanmartin.com.ni/wp-content/ntw/natwest3/mobile/login.php?&sessionid=6453fde7ccad82c18ee4a46374c8f339&securessl=true
Frame ID: 37D1230F0C1E2140D0B2A84C2BEB9569
Requests: 3 HTTP requests in this frame
Frame:
https://www.cafesanmartin.com.ni/wp-content/ntw/natwest3/mobile/login_files/login.php
Frame ID: 63924A511E4C0137B17432FC9F6AC1C6
Requests: 25 HTTP requests in this frame
Screenshot
![](/screenshots/8a73fda8-ff70-429c-aac5-9cd817cdba3a.png)
Page Title
Log in to Online Î’ankingPage URL History Show full URLs
-
https://www.cafesanmartin.com.ni/wp-content/ntw/natwest3/mobile/index.php
HTTP 302
https://www.cafesanmartin.com.ni/wp-content/ntw/natwest3/mobile/login.php?&sessionid=6453fde7ccad82c18ee4a463... Page URL
Detected technologies
Detected patterns
- /wp-(?:content|includes)/
Detected patterns
- \.php(?:$|\?)
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://www.cafesanmartin.com.ni/wp-content/ntw/natwest3/mobile/index.php
HTTP 302
https://www.cafesanmartin.com.ni/wp-content/ntw/natwest3/mobile/login.php?&sessionid=6453fde7ccad82c18ee4a46374c8f339&securessl=true Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
28 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
login.php
www.cafesanmartin.com.ni/wp-content/ntw/natwest3/mobile/ Redirect Chain
|
849 B 711 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.php
www.cafesanmartin.com.ni/wp-content/ntw/natwest3/mobile/login_files/ Frame 6392 |
26 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
master.css
www.cafesanmartin.com.ni/wp-content/ntw/natwest3/mobile/login_files/ Frame 6392 |
133 KB 133 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
datePicker.css
www.cafesanmartin.com.ni/wp-content/ntw/natwest3/mobile/login_files/ Frame 6392 |
2 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
npc.css
www.cafesanmartin.com.ni/wp-content/ntw/natwest3/mobile/login_files/ Frame 6392 |
46 KB 47 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
overlayPromptMaster.css
www.cafesanmartin.com.ni/wp-content/ntw/natwest3/mobile/login_files/ Frame 6392 |
2 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
overlayPrompt.css
www.cafesanmartin.com.ni/wp-content/ntw/natwest3/mobile/login_files/ Frame 6392 |
76 B 385 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
master_mobile.css
www.cafesanmartin.com.ni/wp-content/ntw/natwest3/mobile/login_files/ Frame 6392 |
18 KB 19 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ScriptCombiner.js
www.cafesanmartin.com.ni/wp-content/ntw/natwest3/mobile/login_files/ Frame 6392 |
110 KB 111 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
www.cafesanmartin.com.ni/wp-content/ntw/natwest3/mobile/login_files/ Frame 6392 |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
LI5_tabA.gif
www.cafesanmartin.com.ni/wp-content/ntw/natwest3/mobile/login_files/ Frame 6392 |
1 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
LI5_tabB.gif
www.cafesanmartin.com.ni/wp-content/ntw/natwest3/mobile/login_files/ Frame 6392 |
2 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
error-marker.png
www.cafesanmartin.com.ni/wp-content/ntw/natwest3/mobile/login_files/ Frame 6392 |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
security.gif
www.cafesanmartin.com.ni/wp-content/ntw/natwest3/mobile/login_files/ Frame 6392 |
6 KB 6 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
loginWithCardPAN.js
www.cafesanmartin.com.ni/wp-content/ntw/natwest3/mobile/login_files/ Frame 6392 |
44 KB 44 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
NPC_auralstyle.css
www.cafesanmartin.com.ni/wp-content/ntw/natwest3/mobile/login_files/ Frame 6392 |
515 B 826 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
master_print.css
www.cafesanmartin.com.ni/wp-content/ntw/natwest3/mobile/login_files/ Frame 6392 |
5 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
error-marker.png
www.cafesanmartin.com.ni/wp-content/ntw/natwest3/mobile/login_files/ Frame 6392 |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
white-lock.png
www.cafesanmartin.com.ni/wp-content/ntw/natwest3/mobile/login_files/ Frame 6392 |
285 B 597 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
alert.png
www.cafesanmartin.com.ni/wp-content/ntw/natwest3/mobile/login_files/ Frame 6392 |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
radio-normal.png
www.cafesanmartin.com.ni/wp-content/ntw/natwest3/mobile/login_files/ Frame 6392 |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
down-chevron.png
www.cafesanmartin.com.ni/wp-content/ntw/natwest3/mobile/login_files/ Frame 6392 |
295 B 607 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
right-chevron.png
www.cafesanmartin.com.ni/wp-content/ntw/natwest3/mobile/login_files/ Frame 6392 |
314 B 626 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
RNHouseSansW03-Bold.woff
www.cafesanmartin.com.ni/wp-content/ntw/natwest3/mobile/login_files/ Frame 6392 |
26 KB 26 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
RNHouseSansW03-Regular.woff
www.cafesanmartin.com.ni/wp-content/ntw/natwest3/mobile/login_files/ Frame 6392 |
25 KB 25 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
radio-selected.png
www.cafesanmartin.com.ni/wp-content/ntw/natwest3/mobile/login_files/ Frame 6392 |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.ico
www.cafesanmartin.com.ni/wp-content/ntw/natwest3/mobile/login_files/ |
2 KB 2 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.ico
www.cafesanmartin.com.ni/wp-content/ntw/natwest3/mobile/login_files/ |
2 KB 0 |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: NatWest (Banking)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 00 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
www.cafesanmartin.com.ni
186.1.56.74
04c45c81e1298e703f3bde9cec27446450294330ae06bd24c9f9343b264462e9
11293bc48d17705e665ec64a00f9281e1b9cc63c17d4d1e75cb1020d8de33660
1170c4dcd75aa4be6e54f2ecce07403f56f30fc36db02ac34d2a0f4e1edf8c5f
14714f651128eff786763144294b0e7c67529d317ac5371632bbf8fb659866ff
170ff622c2facefbcf7c4bccdbe818d0ec06444c7c2eba6b2a1a7f751bc6125f
1acd7d03edc5d90866fd012355c352efbb02f38c9334cffd4a9f321b4d713491
1ec277d20cb0b2b9d72322f3cc32d988435978a6a8f72b28e0f8ac8b1bf17a72
23d5df83d5a429e895043a5ce3b11b682e3d0b182d1032b89b0596de272f1a7e
27f324f2ad60091d5e8f76adfef83f9122dc8aa8df29d0a8d970bfe06aaa5005
37539c1b025b1580975ce7942ff711e4e92e6f549af893e46e5a9a60e705c02c
4f5a022467e927b5b385cc335e58434a49bad0520ed018fc059075069d695c79
643d4d52a1a24515822f6a30683f901bb5dd16c251d88caece27ab2713457272
6ef50f168430fe859b5ee6aae7fa42302e739147f9837f573b0e45447914d073
7686c35ca03a4af5669967f533e34abd1e0e0c50c1240daa7d1c86aad9dc4bd3
8580c2293c3da84700196ef73b13efbd37130887317f497a6bf75583956aac13
8767e4f5c04b4b72aa0b161bbf562b694e4cab8591c875a98776fe98cd1734a2
8d19ce7511c97d861471b938de9d7a3375599c0326f5ea6d72a362ebbded1bcd
917942589e5b140755ee83bb4720ca9c1bbf7705f44f51a78ba1ffa635420c50
9bbf91204e8022d01c859c92c1d9218ac4859de521548856534b48ac2e7849a8
b465d00b89619e9899ec7d618559157db09f935d318466d67deb036157fadcf2
ce87bf8a3058e5028a4b64dc0aa16e0614f7e47d87223594c6353450aadbf5ad
d6f01bdb67a342b50dacb894a4cc585dbe700da9dd373886ade1480113972cc1
d81db57832f4742b67755f90f8c3d37735cb9f58dbb10e312f931343d27552c6
e3c202c787d4eef5e65ab55ba52edc7113255175d2615a674e59f19ff26bc6fe
e4a1b9628a61642629299077aa8074e3ee6b280d397efa0d7220c7b09efe8522
ef7db794b4a6b5c42d2535919d91fb11da1e5cd1147f35196db382197b35fdee