nab.com.au.nabsec.services
Open in
urlscan Pro
198.54.126.77
Malicious Activity!
Public Scan
Effective URL: https://nab.com.au.nabsec.services/def/login/
Submission: On February 21 via manual from AU
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on February 21st 2020. Valid for: a year.
This is the only time nab.com.au.nabsec.services was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: NAB Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
4 29 | 198.54.126.77 198.54.126.77 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
25 | 1 |
ASN22612 (NAMECHEAP-NET, US)
PTR: server33-3.web-hosting.com
nab.com.au.nabsec.services |
Apex Domain Subdomains |
Transfer | |
---|---|---|
29 |
nabsec.services
4 redirects
nab.com.au.nabsec.services |
134 KB |
25 | 1 |
Domain | Requested by | |
---|---|---|
29 | nab.com.au.nabsec.services |
4 redirects
nab.com.au.nabsec.services
|
25 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
nab.com.au.nabsec.services Sectigo RSA Domain Validation Secure Server CA |
2020-02-21 - 2021-02-20 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://nab.com.au.nabsec.services/def/login/
Frame ID: C7B6CB50935DB7DC52DAD0F99A580576
Requests: 25 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://nab.com.au.nabsec.services/
HTTP 301
https://nab.com.au.nabsec.services/ HTTP 302
https://nab.com.au.nabsec.services/def HTTP 301
https://nab.com.au.nabsec.services/def/ HTTP 302
https://nab.com.au.nabsec.services/def/login/ Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Font Awesome (Font Scripts) Expand
Detected patterns
- html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://nab.com.au.nabsec.services/
HTTP 301
https://nab.com.au.nabsec.services/ HTTP 302
https://nab.com.au.nabsec.services/def HTTP 301
https://nab.com.au.nabsec.services/def/ HTTP 302
https://nab.com.au.nabsec.services/def/login/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
25 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
nab.com.au.nabsec.services/def/login/ Redirect Chain
|
12 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.css
nab.com.au.nabsec.services/login/ |
17 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
nab.com.au.nabsec.services/bower_components/font-awesome/css/ |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
nab.com.au.nabsec.services/bower_components/jquery/dist/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css.css
nab.com.au.nabsec.services/login/ |
2 KB 921 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
image_item45.png
nab.com.au.nabsec.services/login/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
image_item46.gif
nab.com.au.nabsec.services/login/ |
3 KB 3 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
form.js
nab.com.au.nabsec.services/def/login/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
token.js
nab.com.au.nabsec.services/def/login/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
image_item34.png
nab.com.au.nabsec.services/login/ |
154 B 266 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
image_item22.jpg
nab.com.au.nabsec.services/login/ |
19 KB 19 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
image_item23.gif
nab.com.au.nabsec.services/login/ |
257 B 369 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
image_item39.gif
nab.com.au.nabsec.services/login/ |
2 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dotsfont.woff
nab.com.au.nabsec.services/dotfont/ |
2 KB 3 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
image_item41.gif
nab.com.au.nabsec.services/login/ |
307 B 419 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
image_item21.gif
nab.com.au.nabsec.services/login/ |
100 B 212 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
image_item37.gif
nab.com.au.nabsec.services/login/ |
68 B 179 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
image_item29.gif
nab.com.au.nabsec.services/login/ |
581 B 693 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
image_item31.gif
nab.com.au.nabsec.services/login/ |
449 B 561 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
image_item30.gif
nab.com.au.nabsec.services/login/ |
1 KB 1 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
image_item32.gif
nab.com.au.nabsec.services/login/ |
1 KB 1 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
corpid-b-webfont_001.woff
nab.com.au.nabsec.services/login/ |
25 KB 25 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
corpid-l-webfont_001.woff
nab.com.au.nabsec.services/login/ |
27 KB 27 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
form.js
nab.com.au.nabsec.services/def/login/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
token.js
nab.com.au.nabsec.services/def/login/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: NAB Bank (Banking)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| $ function| jQuery function| letsgo1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
nab.com.au.nabsec.services/def | Name: bid Value: def |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
nab.com.au.nabsec.services
198.54.126.77
04ff4054aedfdc46f0358f8f145717259c3d264f78837b8eb3bdb46024315947
0be93ba9b93250bde05417c35f0e453cc6ca03b5ad40168b63dd7f419a08a5a2
1b2e8307fc3c7bcb22dbc79dbd0e322bc56cb05916a36ff9d7fcff259237dad0
345e5797bde0b78107d25a3ab912482a2009a90dcc37c61e10f04bdf90a5c9e6
38db52c7406151339645f1d9e6642be7e31f97457fad34b541bcee77e58d54ac
40c08695a6bb619ac169d9bdf4f1b0266a5a17bb000fc8bcf77b9ca0a1fc6285
4b0f8a88bea8e8300faf9c6eb50d989aed7b008262dd482f78ed3e340251adc5
4c27e00efc3a284d6406cbe4838292288fd65fb135cb303902e682e7a7a5f473
4f48fca9a73368362a7356a8d3fdcc86b40a174b7b83c80b059a9322d0619e47
680ebc1aecd70eb8791e9fca7d92e873fc94f820c3c22fd38441da7a266db279
740b92b37caf1906cd34828753b3c60f3f92fa7d89c172a757ae8ddb229c413b
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
8740c4494b7a404a10771da97993b6fee7937220bda2d967b47542f6b499f0ad
a0f7466886559e2f009b59c21c80021e45a6b9911f5e25a6e96879c16b269b72
aded0530b852996f0f6d0bdee146023d096aa2c7990805c8f1f90456172b7892
b59dac6fad9c97244268d80748845bb6efac3bac4999809675e742e21c0cfac4
c4d9a3125d8ae44072e64b39bacde45a74d6157c5d8b7e965b9a919739338e84
c7a299c1e3976b682508aeac5138f2f31b289d350e94bbd3ccc4f7570b67dcd0
c8b5c36b604b175f0c6be6b98f40c5b82c05b0a76aadd383a61b0f4fe0b3d264
eda98811a704e8f1dfe866d334073066238c53706e76034e828a14b8eefca2a5