![](/screenshots/8a9fea03-879d-47e7-8a49-b26d4fef1247.png)
current-santan-auth-online.com
Open in
urlscan Pro
91.215.85.14
Malicious Activity!
Public Scan
Effective URL: https://current-santan-auth-online.com/Login.php
Submission: On March 28 via api from BE — Scanned from DE
Summary
TLS certificate: Issued by R3 on March 20th 2024. Valid for: 3 months.
This is the only time current-santan-auth-online.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: TSB Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
16 | 91.215.85.14 91.215.85.14 | 200593 (PROSPERO-AS) (PROSPERO-AS) | |
16 | 1 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
16 |
current-santan-auth-online.com
current-santan-auth-online.com |
226 KB |
16 | 1 |
Domain | Requested by | |
---|---|---|
16 | current-santan-auth-online.com |
current-santan-auth-online.com
|
16 | 1 |
This site contains links to these domains. Also see Links.
Domain |
---|
internetbanking.tsb.co.uk |
tsb.co.uk |
www.tsb.co.uk |
Subject Issuer | Validity | Valid | |
---|---|---|---|
current-santan-auth-online.com R3 |
2024-03-20 - 2024-06-18 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://current-santan-auth-online.com/Login.php
Frame ID: 3FA52A3B023380B02E1FF2EEE84642D8
Requests: 16 HTTP requests in this frame
Screenshot
![](/screenshots/8a9fea03-879d-47e7-8a49-b26d4fef1247.png)
Page Title
LoginPage URL History Show full URLs
-
http://current-santan-auth-online.com/Login.php
HTTP 307
https://current-santan-auth-online.com/Login.php Page URL
Detected technologies
Detected patterns
- \.php(?:$|\?)
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
14 Outgoing links
These are links going to different origins than the main page.
Title: Cookie Policy
Search URL Search Domain Scan URL
Title: How can I tell that this site is secure?
Search URL Search Domain Scan URL
Title: register online
Search URL Search Domain Scan URL
Title: Recover User ID?
Search URL Search Domain Scan URL
Title: 'Forgotten your password and memorable information?'
Search URL Search Domain Scan URL
Title: Find out more
Search URL Search Domain Scan URL
Title: login issues page
Search URL Search Domain Scan URL
Title: useful information page
Search URL Search Domain Scan URL
Title: branch locator page
Search URL Search Domain Scan URL
Title: Malware page
Search URL Search Domain Scan URL
Title: Legal
Search URL Search Domain Scan URL
Title: Privacy
Search URL Search Domain Scan URL
Title: Security
Search URL Search Domain Scan URL
Title: Rates and Charges
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://current-santan-auth-online.com/Login.php
HTTP 307
https://current-santan-auth-online.com/Login.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
Login.php
current-santan-auth-online.com/ Redirect Chain
|
67 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles-min.css
current-santan-auth-online.com/files/css/ |
383 KB 50 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
promotionals-min.css
current-santan-auth-online.com/files/css/ |
46 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.js
current-santan-auth-online.com/files/js/ |
266 KB 75 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo-6-1409059355.png
current-santan-auth-online.com/files/img/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
d631d9e5.vendor.min.css
current-santan-auth-online.com/files/css/ |
12 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
0eb8ac02.tsb-credentials-public.min.css
current-santan-auth-online.com/files/css/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
c2822233.c2822233.alert-icon-100x73-2-1409059243.png
current-santan-auth-online.com/files/img/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
chat_floating.png
current-santan-auth-online.com/files/img/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
print_base-min.css
current-santan-auth-online.com/files/css/ |
6 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
header_bg.png
current-santan-auth-online.com/files/img/ |
195 B 214 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
icons.png
current-santan-auth-online.com/files/img/ |
11 KB 12 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
accordion_part_bg.png
current-santan-auth-online.com/files/img/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
footer_bg.png
current-santan-auth-online.com/files/img/ |
131 B 149 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
basic_commercial_light.woff
current-santan-auth-online.com/files/fonts/ |
54 KB 54 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
current-santan-auth-online.com/files/img/ |
1 KB 545 B |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: TSB Bank (Banking)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onpagereveal function| $ function| jQuery0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
current-santan-auth-online.com
91.215.85.14
2774d359665cfac4626ddcdaf1d550950a6606afae5f5320035a2d1d60759f36
37c0ad8b5bd6c5aba125493d6e0451521be1916c083c03df12570351e29b0705
626706e2e2295ad3c02a8a240a95384646ddebe3fa605d19b00453842b2f1963
84086bb634fc6fd223918894c6b74641811e06e84007937c5809942b7a02ddff
90c0a7006dbae927846b71d7c4c6879ded5e2c910cef63cccd567e0500114f0e
9e02a83526c720a74cd6a82ce4c23716f1b9cbb1f0031143811a16951afed025
9f69a190c3f843da38f6253f08660adf032d25749f738d4d1443ea6cbda7886f
b666b4c7b3aeb887f3129820d7372908bb1e49d08c48e8b53a31f06163c5fc49
be1f97e8e72900fd659456d079a8774251f0b9b2955997190bec58e9a739cea2
c19c8bc8958c5f78f4d7a3a886b79282ca59dc93b9502641b1abbba6bece4abc
c368cbfd778aa397766475527e309ef2550636baeea42412fa179935a808a989
d06a1560daa02939250a623ab4b9c04fa7d48ffca28c63f599378439ad3b322f
e42a8b2609b1c619764f8875e9b1d3772a2e0f7d1921538d16c5dbfae0f52baf
e60dda6134d562944081c711b0bf604322805a2291a58a4804923b6b1cbb2f3f
e64d43def9e8ef1c7b8194da649a17720e7a6659e6fd4028308eb56ccdd8d455
f494bda117644c195a1132b9f4eae9c49baec588efe4366d981aa8ff78551318