declinenow-ubanks.web.app Open in urlscan Pro
199.36.158.100 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://declinenow-ubanks.web.app/
Submission: On July 31 via api (July 31st 2023, 11:55:29 pm UTC) from US — Scanned from AU

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 14 HTTP transactions. The main IP is 199.36.158.100, located in United States and belongs to FASTLY, US. The main domain is declinenow-ubanks.web.app.
TLS certificate: Issued by GTS CA 1D4 on July 10th 2023. Valid for: 3 months.

This is the only time declinenow-ubanks.web.app was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: UBank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
9	199.36.158.100 199.36.158.100	54113 (FASTLY) (FASTLY)
1	104.26.0.226 104.26.0.226	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	163.123.183.69 163.123.183.69	32097 (WII) (WII)
14	4

9 199.36.158.100 (United States)

ASN54113 (FASTLY, US)

declinenow-ubanks.web.app	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.26.0.226 (None, )

ASN13335 (CLOUDFLARENET, US)

api.country.is	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 163.123.183.69 (United States)

ASN32097 (WII, US)

nodejsclusters-98107-0.cloudclusters.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	web.app declinenow-ubanks.web.app	216 KB
3	cloudclusters.net nodejsclusters-98107-0.cloudclusters.net	397 B
1	country.is api.country.is — Cisco Umbrella Rank: 67002	481 B
0	ubank.com.au Failed www.ubank.com.au Failed
14	4

	Domain	Requested by
9	declinenow-ubanks.web.app	declinenow-ubanks.web.app
3	nodejsclusters-98107-0.cloudclusters.net	declinenow-ubanks.web.app
1	api.country.is	declinenow-ubanks.web.app
0	www.ubank.com.au Failed	declinenow-ubanks.web.app
14	4

This site contains no links.

Subject Issuer	Validity	Valid
web.app GTS CA 1D4	`2023-07-10` - `2023-10-08`	3 months	crt.sh
country.is GTS CA 1P5	`2023-06-26` - `2023-09-24`	3 months	crt.sh
*.cloudclusters.net RapidSSL TLS RSA CA G1	`2023-03-13` - `2024-04-12`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://declinenow-ubanks.web.app/
Frame ID: 72C938210E4D592032F79CC789B4F3A3
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

ubank

Detected technologies

Nuxt.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<div [^>]*id="__nuxt"
/_nuxt/

Page Statistics

14
Requests

93 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

317 kB
Transfer

684 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
5 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
declinenow-ubanks.web.app/ 3 KB
1 KB 798ms
235ms Document
text/html 199.36.158.100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://declinenow-ubanks.web.app/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

199.36.158.100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

f282dd8b899067cde9af3390320160bd8737c4aa36042f674fe5f9bf3209ee95

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
cache-control: max-age=3600
content-encoding: br
content-length: 812
content-type: text/html; charset=utf-8
date: Mon, 31 Jul 2023 23:55:23 GMT
etag: "35c002ad043798386672ede87cd68b9bbbf874358f631702cc44c0b5239d5b37-br"
last-modified: Mon, 31 Jul 2023 22:34:57 GMT
strict-transport-security: max-age=31556926; includeSubDomains; preload
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
x-cache-hits: 1
x-served-by: cache-bfi-kbfi7400088-BFI
x-timer: S1690847723.468254,VS0,VE1

GET
H2 200 all.css
declinenow-ubanks.web.app/css/ 205 KB
112 KB 295ms
294ms Stylesheet
text/css 199.36.158.100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://declinenow-ubanks.web.app/css/all.css

Requested by

Host: declinenow-ubanks.web.app
URL: https://declinenow-ubanks.web.app/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

199.36.158.100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

56c54b239ab556fa49b0b0a08e32b8e93163adeb697523f1b5234e7a68e2d20e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://declinenow-ubanks.web.app/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

x-served-by: cache-bfi-kbfi7400088-BFI
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Mon, 31 Jul 2023 23:55:23 GMT
last-modified: Mon, 31 Jul 2023 22:34:57 GMT
x-timer: S1690847724.708957,VS0,VE3
etag: "6ba07394d3f21bb27a7aefe8035e51b20f4162c0e818dcb820cca9d03593ef0a-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/css; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 114685
x-cache-hits: 1

GET
H2 200 6.8384127e8a36870ab7710.2647527606916844.js Show response
declinenow-ubanks.web.app/_nuxt/ 2 KB
1 KB 232ms
231ms Script
text/javascript 199.36.158.100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://declinenow-ubanks.web.app/_nuxt/6.8384127e8a36870ab7710.2647527606916844.js

Requested by

Host: declinenow-ubanks.web.app
URL: https://declinenow-ubanks.web.app/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

199.36.158.100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

cf2a978e69af2415f814dfc3ee4bebdf9de3d8206551ea1802eddea0eb76cacf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://declinenow-ubanks.web.app/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

x-served-by: cache-bfi-kbfi7400088-BFI
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Mon, 31 Jul 2023 23:55:23 GMT
last-modified: Mon, 31 Jul 2023 22:34:57 GMT
x-timer: S1690847724.709265,VS0,VE1
etag: "3d86fc93346307f589b0e3e748155ca348b1421598fe36b155c53e7e7d249f3f-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 1090
x-cache-hits: 1

GET
H2 200 1.bb6f214981248c203ad73.4623347280076144.js Show response
declinenow-ubanks.web.app/_nuxt/ 196 KB
60 KB 476ms
475ms Script
text/javascript 199.36.158.100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://declinenow-ubanks.web.app/_nuxt/1.bb6f214981248c203ad73.4623347280076144.js

Requested by

Host: declinenow-ubanks.web.app
URL: https://declinenow-ubanks.web.app/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

199.36.158.100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

a6d9b88c80a3d59419b6298ec8755d8dc32a6aecbcad7f69a60ec94c9121f4b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://declinenow-ubanks.web.app/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

x-served-by: cache-bfi-kbfi7400088-BFI
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Mon, 31 Jul 2023 23:55:23 GMT
last-modified: Mon, 31 Jul 2023 22:34:57 GMT
x-timer: S1690847724.709282,VS0,VE4
etag: "02e8e0b8a1c553666132af4846e979f25dc6a8871cae922644abec79e5a8f060-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 60787
x-cache-hits: 1

GET
H2 200 7.12dbc447fae6e1151a5e3.4623347280076144.js Show response
declinenow-ubanks.web.app/_nuxt/ 82 KB
20 KB 234ms
233ms Script
text/javascript 199.36.158.100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://declinenow-ubanks.web.app/_nuxt/7.12dbc447fae6e1151a5e3.4623347280076144.js

Requested by

Host: declinenow-ubanks.web.app
URL: https://declinenow-ubanks.web.app/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

199.36.158.100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

cd5df10f18671eabf9ea5602792462061406e4a225d8d7bd394f13b7190751d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://declinenow-ubanks.web.app/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

x-served-by: cache-bfi-kbfi7400088-BFI
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Mon, 31 Jul 2023 23:55:23 GMT
last-modified: Mon, 31 Jul 2023 22:34:57 GMT
x-timer: S1690847724.709682,VS0,VE1
etag: "c7d97d2f8b9f9aec203039eed5638de3deec4f56de918d492c49dfa91fc8ae94-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 20585
x-cache-hits: 1

GET
H2 200 0.d45d2c1f1ac272d9bf5d3.4623347280076144.js Show response
declinenow-ubanks.web.app/_nuxt/ 119 B
202 B 233ms
232ms Script
text/javascript 199.36.158.100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://declinenow-ubanks.web.app/_nuxt/0.d45d2c1f1ac272d9bf5d3.4623347280076144.js

Requested by

Host: declinenow-ubanks.web.app
URL: https://declinenow-ubanks.web.app/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

199.36.158.100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

29d1fcb647221267dcf98b6872cad8548a12ad476f596b2792e71805b6280df9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://declinenow-ubanks.web.app/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

x-served-by: cache-bfi-kbfi7400088-BFI
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Mon, 31 Jul 2023 23:55:23 GMT
last-modified: Mon, 31 Jul 2023 22:34:57 GMT
x-timer: S1690847724.709440,VS0,VE1
etag: "934661474f9f496307ec1b83e4500207efe2b035cb209768b30b3d26fb35837f-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 90
x-cache-hits: 1

GET
H2 200 2.9fbf47f0a7bd2e2b4fad3.4623347280076144.js Show response
declinenow-ubanks.web.app/_nuxt/ 27 KB
9 KB 236ms
235ms Script
text/javascript 199.36.158.100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://declinenow-ubanks.web.app/_nuxt/2.9fbf47f0a7bd2e2b4fad3.4623347280076144.js

Requested by

Host: declinenow-ubanks.web.app
URL: https://declinenow-ubanks.web.app/_nuxt/6.8384127e8a36870ab7710.2647527606916844.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

199.36.158.100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

1c2d390c0c023ba77a828697c2f9391c698697e848e72a950b75d684acf2609b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://declinenow-ubanks.web.app/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

x-served-by: cache-bfi-kbfi7400088-BFI
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Mon, 31 Jul 2023 23:55:24 GMT
last-modified: Mon, 31 Jul 2023 22:34:57 GMT
x-timer: S1690847725.541496,VS0,VE1
etag: "5c1a2665f7cce3d72084689ed4b430e5ff23f557dd00e0012838d70d0cd861f2-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 9274
x-cache-hits: 1

GET
H2 200 8.f3a13e8873c9d117a6c63.4623347280076144.js Show response
declinenow-ubanks.web.app/_nuxt/ 22 KB
6 KB 239ms
238ms Script
text/javascript 199.36.158.100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://declinenow-ubanks.web.app/_nuxt/8.f3a13e8873c9d117a6c63.4623347280076144.js

Requested by

Host: declinenow-ubanks.web.app
URL: https://declinenow-ubanks.web.app/_nuxt/6.8384127e8a36870ab7710.2647527606916844.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

199.36.158.100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

bde016c14f81018a71651df29f9ecb39391a56e1f0ee57600658a5c70db06405

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://declinenow-ubanks.web.app/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

x-served-by: cache-bfi-kbfi7400088-BFI
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Mon, 31 Jul 2023 23:55:24 GMT
last-modified: Mon, 31 Jul 2023 22:34:57 GMT
x-timer: S1690847725.541586,VS0,VE2
etag: "60cab89b422c17ed6a105efea541d8fdebc7a9cf1e854ad0d29a4b6c3fab2d25-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 6174
x-cache-hits: 1

GET
H2 200 5.d7d1f5b32ed5ac6e15113.4623347280076144.js Show response
declinenow-ubanks.web.app/_nuxt/ 46 KB
7 KB 243ms
242ms Script
text/javascript 199.36.158.100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://declinenow-ubanks.web.app/_nuxt/5.d7d1f5b32ed5ac6e15113.4623347280076144.js

Requested by

Host: declinenow-ubanks.web.app
URL: https://declinenow-ubanks.web.app/_nuxt/6.8384127e8a36870ab7710.2647527606916844.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

199.36.158.100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

6f2641d74827177452e73ef87791459898cf1c000df652f9dcb40b16e4384632

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://declinenow-ubanks.web.app/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

x-served-by: cache-bfi-kbfi7400088-BFI
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Mon, 31 Jul 2023 23:55:24 GMT
last-modified: Mon, 31 Jul 2023 22:34:57 GMT
x-timer: S1690847725.541656,VS0,VE4
etag: "3c594afdef962c362e79c6116f596be17f1912ffdf0bde95d529089d39ee352f-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 6728
x-cache-hits: 1

GET
DATA 200
OK truncated
/ 17 KB
17 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 20dfc900c1a420e37d3f927022783b152ee0984233bff9e7455a127d97b9c6f3

Request headers

Referer
Origin: https://declinenow-ubanks.web.app
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Content-Type: font/woff2

GET
H2 200 / Show response
api.country.is/ 38 B
481 B 874ms
396ms Fetch
application/json 104.26.0.226
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.country.is/
Requested by: Host: declinenow-ubanks.web.app
URL: https://declinenow-ubanks.web.app/_nuxt/5.d7d1f5b32ed5ac6e15113.4623347280076144.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.0.226 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4cea382f1aa9bf42f7ee3bf51cf1ed182860be221bdb3e7fb9fa8689c2e01487

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://declinenow-ubanks.web.app/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 31 Jul 2023 23:55:25 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "26-nG0F/1DEPkfDpr6Ync8F9uemLp4"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=21SKMvHW9MxvbSCMZqS4ANogcTzLu%2FAaOWouW2ZDjukVM%2FCR0FBN26rKcdo34lzwi8R8DchyXP8j0zXwf%2F9sbe8JgOEbw3gphYoXADjByrY2zgq4Qu1Ra%2BDy7WtGwaAf"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: no-cache
cf-ray: 7ef9c5aa9b1faaf3-SYD
content-length: 38

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d310cc9a575659f46afe99fb7328b3803176a34e7fd02f9a5b9f4d287064536f

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 17 KB
17 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 07f30e0930956e9c5605b7e23122bb88dc36887e7d8e29a0b9fe81e69be866e0

Request headers

Referer
Origin: https://declinenow-ubanks.web.app
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Content-Type: font/woff2

GET
DATA 200
OK truncated
/ 20 KB
20 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7fc3aa8a33550a9ac7c660b3f7ce1f4367dd9bd6a28cf4a151835a2fc0325ac7

Request headers

Referer
Origin: https://declinenow-ubanks.web.app
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Content-Type: font/woff2

GET sparkle-icons.woff
www.ubank.com.au/welcome/assets/fonts/sparkle-icons/ 0
0

GET
DATA 200
OK truncated
/ 47 KB
47 KB Font
font/woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 447472d83625235afec8c0378a9116fc457b3519676f999ed1b825d0a6197c6c

Request headers

Referer
Origin: https://declinenow-ubanks.web.app
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Content-Type: font/woff

GET
H2 200 66.203.112.168 Show response
nodejsclusters-98107-0.cloudclusters.net/checkIp/ 2 B
199 B 1412ms
377ms Fetch
text/plain 163.123.183.69
WII

General

Check archive.org

Show headers Download Go to

Full URL

https://nodejsclusters-98107-0.cloudclusters.net/checkIp/66.203.112.168

Requested by

Host: declinenow-ubanks.web.app
URL: https://declinenow-ubanks.web.app/_nuxt/5.d7d1f5b32ed5ac6e15113.4623347280076144.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

163.123.183.69 , United States, ASN32097 (WII, US),

Reverse DNS

Software

/ Express

Resource Hash

565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://declinenow-ubanks.web.app/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

access-control-allow-origin: *
date: Mon, 31 Jul 2023 23:55:26 GMT
strict-transport-security: max-age=15724800; includeSubDomains
x-powered-by: Express
content-length: 2
etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
content-type: text/plain; charset=utf-8

POST
H2 200 giveVisitor Show response
nodejsclusters-98107-0.cloudclusters.net/ 2 B
198 B 483ms
482ms XHR
text/plain 163.123.183.69
WII

General

Check archive.org

Show headers Download Go to

Full URL

https://nodejsclusters-98107-0.cloudclusters.net/giveVisitor

Requested by

Host: declinenow-ubanks.web.app
URL: https://declinenow-ubanks.web.app/_nuxt/2.9fbf47f0a7bd2e2b4fad3.4623347280076144.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

163.123.183.69 , United States, ASN32097 (WII, US),

Reverse DNS

Software

/ Express

Resource Hash

565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://declinenow-ubanks.web.app/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
Content-Type: application/json

Response headers

access-control-allow-origin: *
date: Mon, 31 Jul 2023 23:55:27 GMT
strict-transport-security: max-age=15724800; includeSubDomains
x-powered-by: Express
content-length: 2
etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
content-type: text/plain; charset=utf-8

OPTIONS
H2 204 giveVisitor
nodejsclusters-98107-0.cloudclusters.net/ 0
0 273ms
273ms Preflight 163.123.183.69
WII

General

Check archive.org

Show headers Download Go to

Full URL

https://nodejsclusters-98107-0.cloudclusters.net/giveVisitor

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

163.123.183.69 , United States, ASN32097 (WII, US),

Reverse DNS

Software

/ Express

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://declinenow-ubanks.web.app
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
access-control-allow-origin: *
date: Mon, 31 Jul 2023 23:55:27 GMT
strict-transport-security: max-age=15724800; includeSubDomains
vary: Access-Control-Request-Headers
x-powered-by: Express

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.ubank.com.au
URL: https://www.ubank.com.au/welcome/assets/fonts/sparkle-icons/sparkle-icons.woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: UBank (Banking)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://declinenow-ubanks.web.app/ Message: Access to font at 'https://www.ubank.com.au/welcome/assets/fonts/sparkle-icons/sparkle-icons.woff' from origin 'https://declinenow-ubanks.web.app' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://www.ubank.com.au/welcome/assets/fonts/sparkle-icons/sparkle-icons.woff Message: Failed to load resource: net::ERR_FAILED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.country.is
declinenow-ubanks.web.app
nodejsclusters-98107-0.cloudclusters.net
www.ubank.com.au
www.ubank.com.au
104.26.0.226
163.123.183.69
199.36.158.100
07f30e0930956e9c5605b7e23122bb88dc36887e7d8e29a0b9fe81e69be866e0
1c2d390c0c023ba77a828697c2f9391c698697e848e72a950b75d684acf2609b
20dfc900c1a420e37d3f927022783b152ee0984233bff9e7455a127d97b9c6f3
29d1fcb647221267dcf98b6872cad8548a12ad476f596b2792e71805b6280df9
447472d83625235afec8c0378a9116fc457b3519676f999ed1b825d0a6197c6c
4cea382f1aa9bf42f7ee3bf51cf1ed182860be221bdb3e7fb9fa8689c2e01487
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
56c54b239ab556fa49b0b0a08e32b8e93163adeb697523f1b5234e7a68e2d20e
6f2641d74827177452e73ef87791459898cf1c000df652f9dcb40b16e4384632
7fc3aa8a33550a9ac7c660b3f7ce1f4367dd9bd6a28cf4a151835a2fc0325ac7
a6d9b88c80a3d59419b6298ec8755d8dc32a6aecbcad7f69a60ec94c9121f4b0
bde016c14f81018a71651df29f9ecb39391a56e1f0ee57600658a5c70db06405
cd5df10f18671eabf9ea5602792462061406e4a225d8d7bd394f13b7190751d5
cf2a978e69af2415f814dfc3ee4bebdf9de3d8206551ea1802eddea0eb76cacf
d310cc9a575659f46afe99fb7328b3803176a34e7fd02f9a5b9f4d287064536f
f282dd8b899067cde9af3390320160bd8737c4aa36042f674fe5f9bf3209ee95

declinenow-ubanks.web.app Open in urlscan Pro 199.36.158.100 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

14 Requests

93 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

4 IPs

2 Countries

317 kBTransfer

684 kBSize

0 Cookies

0 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

0 Cookies

2 Console Messages

Security Headers

Indicators

declinenow-ubanks.web.app Open in urlscan Pro
199.36.158.100 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

93 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

317 kB
Transfer

684 kB
Size

0
Cookies

14 HTTP transactions
5 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!