nbglogin.xyz Open in urlscan Pro
107.175.240.161 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://nbglogin.xyz/cf0cd/
Effective URL:
https://nbglogin.xyz/cf0cd/default.php
Submission: On March 11 via automatic, source phishtank (March 11th 2022, 9:08:31 am UTC) — Scanned from DE

Summary HTTP 23 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 23 HTTP transactions. The main IP is 107.175.240.161, located in United States and belongs to AS-COLOCROSSING, US. The main domain is nbglogin.xyz.
TLS certificate: Issued by R3 on March 10th 2022. Valid for: 3 months.

This is the only time nbglogin.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: National Bank of Greece (Banking)

Domain & IP information

	IP Address		AS Autonomous System
23	107.175.240.161 107.175.240.161		36352 (AS-COLOCR...) (AS-COLOCROSSING)
23	1

23 107.175.240.161 (United States)

ASN36352 (AS-COLOCROSSING, US)
PTR: 107-175-240-161-host.colocrossing.com

nbglogin.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
23	nbglogin.xyz nbglogin.xyz	922 KB
23	1

	Domain	Requested by
23	nbglogin.xyz	nbglogin.xyz
23	1

This site contains no links.

Subject Issuer	Validity	Valid
nbglogin.xyz R3	`2022-03-10` - `2022-06-08`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://nbglogin.xyz/cf0cd/default.php
Frame ID: 07A1A80D8F59176AEBE5837930FBCFB9
Requests: 23 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

NBG i-bank

Page URL History Show full URLs

https://nbglogin.xyz/cf0cd/ Page URL
https://nbglogin.xyz/cf0cd/default.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

23
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

922 kB
Transfer

927 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://nbglogin.xyz/cf0cd/ Page URL
https://nbglogin.xyz/cf0cd/default.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

23 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response nbglogin.xyz/cf0cd/	3 KB 1 KB	354ms 148ms	Document text/html	107.175.240.161 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Full URL https://nbglogin.xyz/cf0cd/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.175.240.161 , United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS 107-175-240-161-host.colocrossing.com Software nginx / PleskLin Resource Hash `cb1ed1360b852f14f1d857fc736f7447167aabcb21f91a3a142179e31158ade5` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers server nginx date Fri, 11 Mar 2022 09:08:24 GMT content-type text/html; charset=UTF-8 content-length 990 vary Accept-Encoding content-encoding gzip x-powered-by PleskLin
GET H2	200	style6.css nbglogin.xyz/cf0cd/src/css/	198 KB 199 KB	373ms 373ms	Stylesheet text/css	107.175.240.161 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Full URL https://nbglogin.xyz/cf0cd/src/css/style6.css Requested by Host: nbglogin.xyz URL: https://nbglogin.xyz/cf0cd/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.175.240.161 , United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS 107-175-240-161-host.colocrossing.com Software nginx / PleskLin Resource Hash `eee0de974dc453065f99ef24913aad33ed87c19841d8b1269786e27378fcb53b` Request headers Accept-Language de-DE,de;q=0.9 Referer https://nbglogin.xyz/cf0cd/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Fri, 11 Mar 2022 09:08:25 GMT last-modified Fri, 11 Mar 2022 07:16:18 GMT server nginx x-powered-by PleskLin etag "622af742-31997" content-type text/css accept-ranges bytes content-length 203159
GET H2	200	logo.545b013c218ea4ff3ba78d121759aba6.svg nbglogin.xyz/cf0cd/src/img/	14 KB 14 KB	475ms 475ms	Image image/svg+xml	107.175.240.161 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Show image Full URL https://nbglogin.xyz/cf0cd/src/img/logo.545b013c218ea4ff3ba78d121759aba6.svg Requested by Host: nbglogin.xyz URL: https://nbglogin.xyz/cf0cd/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.175.240.161 , United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS 107-175-240-161-host.colocrossing.com Software nginx / PleskLin Resource Hash `a7291d2136d459077949df2e28734f6307acd3b245d20e8958b07dfd81f23951` Request headers Accept-Language de-DE,de;q=0.9 Referer https://nbglogin.xyz/cf0cd/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Fri, 11 Mar 2022 09:08:25 GMT last-modified Fri, 11 Mar 2022 07:16:19 GMT server nginx x-powered-by PleskLin etag "622af743-36e0" content-type image/svg+xml accept-ranges bytes content-length 14048
GET H2	200	nbg-logo-full-black.f26495ed09f202369ae54fbb35eb5631.svg nbglogin.xyz/cf0cd/src/img/	57 KB 57 KB	475ms 475ms	Image image/svg+xml	107.175.240.161 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Show image Full URL https://nbglogin.xyz/cf0cd/src/img/nbg-logo-full-black.f26495ed09f202369ae54fbb35eb5631.svg Requested by Host: nbglogin.xyz URL: https://nbglogin.xyz/cf0cd/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.175.240.161 , United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS 107-175-240-161-host.colocrossing.com Software nginx / PleskLin Resource Hash `7583021663983a838e88f47a0721d751a51a302d45c69595780c083cd2e99909` Request headers Accept-Language de-DE,de;q=0.9 Referer https://nbglogin.xyz/cf0cd/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Fri, 11 Mar 2022 09:08:25 GMT last-modified Fri, 11 Mar 2022 07:16:19 GMT server nginx x-powered-by PleskLin etag "622af743-e2ac" content-type image/svg+xml accept-ranges bytes content-length 58028
GET H2	404	PFDinDisplayPro-Light.23cdddacd0d56977093551f2faea9a13.woff2 nbglogin.xyz/cf0cd/src/css/images/	0 0	225ms 225ms	Font text/html	107.175.240.161 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Full URL https://nbglogin.xyz/cf0cd/src/css/images/PFDinDisplayPro-Light.23cdddacd0d56977093551f2faea9a13.woff2 Requested by Host: nbglogin.xyz URL: https://nbglogin.xyz/cf0cd/src/css/style6.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.175.240.161 , United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS 107-175-240-161-host.colocrossing.com Software nginx / Resource Hash Request headers Referer https://nbglogin.xyz/cf0cd/src/css/style6.css Origin https://nbglogin.xyz Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Fri, 11 Mar 2022 09:08:25 GMT last-modified Thu, 10 Mar 2022 01:02:39 GMT server nginx accept-ranges bytes etag "328-5d9d2c54b7433" content-length 808 content-type text/html
GET H2	404	PFDinDisplayPro-Regular.840952ed9468a2c7444f89b6f748e734.woff2 nbglogin.xyz/cf0cd/src/css/images/	0 0	235ms 235ms	Font text/html	107.175.240.161 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Full URL https://nbglogin.xyz/cf0cd/src/css/images/PFDinDisplayPro-Regular.840952ed9468a2c7444f89b6f748e734.woff2 Requested by Host: nbglogin.xyz URL: https://nbglogin.xyz/cf0cd/src/css/style6.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.175.240.161 , United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS 107-175-240-161-host.colocrossing.com Software nginx / Resource Hash Request headers Referer https://nbglogin.xyz/cf0cd/src/css/style6.css Origin https://nbglogin.xyz Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Fri, 11 Mar 2022 09:08:25 GMT last-modified Thu, 10 Mar 2022 01:02:39 GMT server nginx accept-ranges bytes etag "328-5d9d2c54b7433" content-length 808 content-type text/html
GET H2	404	PFDinDisplayPro-Light.9a5171a196de11651813859c360f195f.woff nbglogin.xyz/cf0cd/src/css/images/	0 0	226ms 226ms	Font text/html	107.175.240.161 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Full URL https://nbglogin.xyz/cf0cd/src/css/images/PFDinDisplayPro-Light.9a5171a196de11651813859c360f195f.woff Requested by Host: nbglogin.xyz URL: https://nbglogin.xyz/cf0cd/src/css/style6.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.175.240.161 , United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS 107-175-240-161-host.colocrossing.com Software nginx / Resource Hash Request headers Referer https://nbglogin.xyz/cf0cd/src/css/style6.css Origin https://nbglogin.xyz Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Fri, 11 Mar 2022 09:08:25 GMT last-modified Thu, 10 Mar 2022 01:02:39 GMT server nginx accept-ranges bytes etag "328-5d9d2c54b7433" content-length 808 content-type text/html
GET H2	404	PFDinDisplayPro-Regular.21be48ba435316c8a4cd39438cd89083.woff nbglogin.xyz/cf0cd/src/css/images/	0 0	236ms 236ms	Font text/html	107.175.240.161 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Full URL https://nbglogin.xyz/cf0cd/src/css/images/PFDinDisplayPro-Regular.21be48ba435316c8a4cd39438cd89083.woff Requested by Host: nbglogin.xyz URL: https://nbglogin.xyz/cf0cd/src/css/style6.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.175.240.161 , United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS 107-175-240-161-host.colocrossing.com Software nginx / Resource Hash Request headers Referer https://nbglogin.xyz/cf0cd/src/css/style6.css Origin https://nbglogin.xyz Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Fri, 11 Mar 2022 09:08:25 GMT last-modified Thu, 10 Mar 2022 01:02:39 GMT server nginx accept-ranges bytes etag "328-5d9d2c54b7433" content-length 808 content-type text/html
GET H2	200	Primary Request default.php Show response nbglogin.xyz/cf0cd/	9 KB 3 KB	153ms 153ms	Document text/html	107.175.240.161 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Full URL https://nbglogin.xyz/cf0cd/default.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.175.240.161 , United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS 107-175-240-161-host.colocrossing.com Software nginx / PleskLin Resource Hash `8c01c5706f7475376c8944119f0992c102311fb459db401bd27467819fa87f46` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://nbglogin.xyz/cf0cd/ Response headers server nginx date Fri, 11 Mar 2022 09:08:27 GMT content-type text/html; charset=UTF-8 content-length 2541 vary Accept-Encoding content-encoding gzip x-powered-by PleskLin
GET H2	200	style5.css nbglogin.xyz/cf0cd/src/	238 KB 239 KB	335ms 335ms	Stylesheet text/css	107.175.240.161 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Full URL https://nbglogin.xyz/cf0cd/src/style5.css Requested by Host: nbglogin.xyz URL: https://nbglogin.xyz/cf0cd/default.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.175.240.161 , United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS 107-175-240-161-host.colocrossing.com Software nginx / PleskLin Resource Hash `d9bc18485c9c735a09443571ddefdff250e8c9cc72e80557253eb3e43f1e6ae9` Request headers Accept-Language de-DE,de;q=0.9 Referer https://nbglogin.xyz/cf0cd/default.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Fri, 11 Mar 2022 09:08:27 GMT last-modified Fri, 11 Mar 2022 07:16:19 GMT server nginx x-powered-by PleskLin etag "622af743-3b88f" content-type text/css accept-ranges bytes content-length 243855
GET H2	200	login-logo.el.png nbglogin.xyz/cf0cd/src/img/	26 KB 26 KB	638ms 637ms	Image image/png	107.175.240.161 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Show image Full URL https://nbglogin.xyz/cf0cd/src/img/login-logo.el.png Requested by Host: nbglogin.xyz URL: https://nbglogin.xyz/cf0cd/default.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.175.240.161 , United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS 107-175-240-161-host.colocrossing.com Software nginx / PleskLin Resource Hash `909457e7d2ab71d52c2fa3386917fee5031be62e179b01804940a6cc9f5d61ac` Request headers Accept-Language de-DE,de;q=0.9 Referer https://nbglogin.xyz/cf0cd/default.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Fri, 11 Mar 2022 09:08:27 GMT last-modified Fri, 11 Mar 2022 07:16:19 GMT server nginx x-powered-by PleskLin etag "622af743-691b" content-type image/png accept-ranges bytes content-length 26907
GET H2	200	new-login-big.66c1b00b0c38dbef35ad2235cc7203a2.jpg nbglogin.xyz/cf0cd/src/images/	87 KB 87 KB	575ms 574ms	Image image/jpeg	107.175.240.161 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Show image Full URL https://nbglogin.xyz/cf0cd/src/images/new-login-big.66c1b00b0c38dbef35ad2235cc7203a2.jpg Requested by Host: nbglogin.xyz URL: https://nbglogin.xyz/cf0cd/src/style5.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.175.240.161 , United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS 107-175-240-161-host.colocrossing.com Software nginx / PleskLin Resource Hash `b6a641e96d081785173e64c24b36a0b3828c2b4ca65c82b872edcd0a5a3eb4b3` Request headers Accept-Language de-DE,de;q=0.9 Referer https://nbglogin.xyz/cf0cd/src/style5.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Fri, 11 Mar 2022 09:08:28 GMT last-modified Fri, 11 Mar 2022 07:16:18 GMT server nginx x-powered-by PleskLin etag "622af742-15b30" content-type image/jpeg accept-ranges bytes content-length 88880
GET H2	200	help-faq.09d363d89aba54167e4e163aef23d5bd.svg nbglogin.xyz/cf0cd/src/icons/	2 KB 3 KB	764ms 764ms	Image image/svg+xml	107.175.240.161 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Show image Full URL https://nbglogin.xyz/cf0cd/src/icons/help-faq.09d363d89aba54167e4e163aef23d5bd.svg Requested by Host: nbglogin.xyz URL: https://nbglogin.xyz/cf0cd/src/style5.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.175.240.161 , United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS 107-175-240-161-host.colocrossing.com Software nginx / PleskLin Resource Hash `161761d367e7686d40033c1a0daeb88006e9e90b676c3e1368362748a2791fda` Request headers Accept-Language de-DE,de;q=0.9 Referer https://nbglogin.xyz/cf0cd/src/style5.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Fri, 11 Mar 2022 09:08:29 GMT last-modified Fri, 11 Mar 2022 07:16:19 GMT server nginx x-powered-by PleskLin etag "622af743-9dd" content-type image/svg+xml accept-ranges bytes content-length 2525
GET H2	200	visibility.d128f570a1a619be86a37334ffc80b37.svg nbglogin.xyz/cf0cd/src/icons/	792 B 965 B	1068ms 1068ms	Image image/svg+xml	107.175.240.161 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Show image Full URL https://nbglogin.xyz/cf0cd/src/icons/visibility.d128f570a1a619be86a37334ffc80b37.svg Requested by Host: nbglogin.xyz URL: https://nbglogin.xyz/cf0cd/src/style5.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.175.240.161 , United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS 107-175-240-161-host.colocrossing.com Software nginx / PleskLin Resource Hash `d01323b878d66d88ef695648887461a1f3843853b8afea91f121483a0512f34d` Request headers Accept-Language de-DE,de;q=0.9 Referer https://nbglogin.xyz/cf0cd/src/style5.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Fri, 11 Mar 2022 09:08:29 GMT etag "318-5d9ec1b6a4ab2" last-modified Fri, 11 Mar 2022 07:16:19 GMT server nginx x-powered-by PleskLin content-type image/svg+xml x-accel-version 0.01 accept-ranges bytes content-length 792
GET H2	200	fb.ab304d17b9496bc6b935c4432936bd0c.svg nbglogin.xyz/cf0cd/src/icons/	1 KB 1 KB	1068ms 1065ms	Image image/svg+xml	107.175.240.161 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Show image Full URL https://nbglogin.xyz/cf0cd/src/icons/fb.ab304d17b9496bc6b935c4432936bd0c.svg Requested by Host: nbglogin.xyz URL: https://nbglogin.xyz/cf0cd/src/style5.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.175.240.161 , United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS 107-175-240-161-host.colocrossing.com Software nginx / PleskLin Resource Hash `ab9872644e58c312c6c45df79fd68e005b03423385801e0689d96cadbd0620bb` Request headers Accept-Language de-DE,de;q=0.9 Referer https://nbglogin.xyz/cf0cd/src/style5.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Fri, 11 Mar 2022 09:08:29 GMT last-modified Fri, 11 Mar 2022 07:16:19 GMT server nginx x-powered-by PleskLin etag "622af743-41d" content-type image/svg+xml accept-ranges bytes content-length 1053
GET H2	200	twitter.82ce7df40056fcadd0606296fd2fd6cc.svg nbglogin.xyz/cf0cd/src/icons/	2 KB 2 KB	1069ms 1066ms	Image image/svg+xml	107.175.240.161 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Show image Full URL https://nbglogin.xyz/cf0cd/src/icons/twitter.82ce7df40056fcadd0606296fd2fd6cc.svg Requested by Host: nbglogin.xyz URL: https://nbglogin.xyz/cf0cd/src/style5.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.175.240.161 , United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS 107-175-240-161-host.colocrossing.com Software nginx / PleskLin Resource Hash `a2f2447ea2c696232412fb46b12c8344dc93740b712a8689d324031e0428beb2` Request headers Accept-Language de-DE,de;q=0.9 Referer https://nbglogin.xyz/cf0cd/src/style5.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Fri, 11 Mar 2022 09:08:29 GMT last-modified Fri, 11 Mar 2022 07:16:19 GMT server nginx x-powered-by PleskLin etag "622af743-84d" content-type image/svg+xml accept-ranges bytes content-length 2125
GET H2	200	youtube.487fffeb171ea4b2b655013e3d76a6a7.svg nbglogin.xyz/cf0cd/src/icons/	3 KB 3 KB	1068ms 1066ms	Image image/svg+xml	107.175.240.161 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Show image Full URL https://nbglogin.xyz/cf0cd/src/icons/youtube.487fffeb171ea4b2b655013e3d76a6a7.svg Requested by Host: nbglogin.xyz URL: https://nbglogin.xyz/cf0cd/src/style5.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.175.240.161 , United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS 107-175-240-161-host.colocrossing.com Software nginx / PleskLin Resource Hash `91dc715405d0bb25103890b512621749faeacf1fb13299fbda4eac81f15e7cab` Request headers Accept-Language de-DE,de;q=0.9 Referer https://nbglogin.xyz/cf0cd/src/style5.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Fri, 11 Mar 2022 09:08:29 GMT last-modified Fri, 11 Mar 2022 07:16:19 GMT server nginx x-powered-by PleskLin etag "622af743-bda" content-type image/svg+xml accept-ranges bytes content-length 3034
GET H2	200	linkedin.8d26e4a4e8edd5cb6c5ce18076102dc3.svg nbglogin.xyz/cf0cd/src/icons/	2 KB 2 KB	1067ms 1066ms	Image image/svg+xml	107.175.240.161 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Show image Full URL https://nbglogin.xyz/cf0cd/src/icons/linkedin.8d26e4a4e8edd5cb6c5ce18076102dc3.svg Requested by Host: nbglogin.xyz URL: https://nbglogin.xyz/cf0cd/src/style5.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.175.240.161 , United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS 107-175-240-161-host.colocrossing.com Software nginx / PleskLin Resource Hash `724be1d544d3f4044e97e8e515f23c0f33f08e96e421021c6729947e62f10642` Request headers Accept-Language de-DE,de;q=0.9 Referer https://nbglogin.xyz/cf0cd/src/style5.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Fri, 11 Mar 2022 09:08:29 GMT last-modified Fri, 11 Mar 2022 07:16:19 GMT server nginx x-powered-by PleskLin etag "622af743-794" content-type image/svg+xml accept-ranges bytes content-length 1940
GET H2	200	email.58449ee1338aaa0ed3b91944e1c7812c.svg nbglogin.xyz/cf0cd/src/icons/	1 KB 1 KB	976ms 975ms	Image image/svg+xml	107.175.240.161 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Show image Full URL https://nbglogin.xyz/cf0cd/src/icons/email.58449ee1338aaa0ed3b91944e1c7812c.svg Requested by Host: nbglogin.xyz URL: https://nbglogin.xyz/cf0cd/src/style5.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.175.240.161 , United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS 107-175-240-161-host.colocrossing.com Software nginx / PleskLin Resource Hash `d6497465709e16d6be1151fc014554b415f7b355024cec20e6a450bf6ab2cbd2` Request headers Accept-Language de-DE,de;q=0.9 Referer https://nbglogin.xyz/cf0cd/src/style5.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Fri, 11 Mar 2022 09:08:29 GMT last-modified Fri, 11 Mar 2022 07:16:19 GMT server nginx x-powered-by PleskLin etag "622af743-4e5" content-type image/svg+xml accept-ranges bytes content-length 1253
GET H2	200	PFDinDisplayPro-Light.23cdddacd0d56977093551f2faea9a13.woff2 nbglogin.xyz/cf0cd/src/images/	93 KB 94 KB	987ms 985ms	Font font/woff2	107.175.240.161 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Full URL https://nbglogin.xyz/cf0cd/src/images/PFDinDisplayPro-Light.23cdddacd0d56977093551f2faea9a13.woff2 Requested by Host: nbglogin.xyz URL: https://nbglogin.xyz/cf0cd/src/style5.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.175.240.161 , United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS 107-175-240-161-host.colocrossing.com Software nginx / PleskLin Resource Hash `9ffdc3a68b780337a39d808139258907be67d951cc439a149443e4da7b36129e` Request headers Referer https://nbglogin.xyz/cf0cd/src/style5.css Origin https://nbglogin.xyz Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Fri, 11 Mar 2022 09:08:29 GMT last-modified Fri, 11 Mar 2022 07:16:19 GMT server nginx x-powered-by PleskLin etag "622af743-17570" content-type font/woff2 accept-ranges bytes content-length 95600
GET H2	200	PFDinDisplayPro-Medium.61e7fd90675f0eb31beed62b660edde2.woff2 nbglogin.xyz/cf0cd/src/images/	92 KB 93 KB	965ms 964ms	Font font/woff2	107.175.240.161 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Full URL https://nbglogin.xyz/cf0cd/src/images/PFDinDisplayPro-Medium.61e7fd90675f0eb31beed62b660edde2.woff2 Requested by Host: nbglogin.xyz URL: https://nbglogin.xyz/cf0cd/src/style5.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.175.240.161 , United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS 107-175-240-161-host.colocrossing.com Software nginx / PleskLin Resource Hash `657bea5fc93d3f34725e07ac72fd20201673054ebe4e88507efee5b8331d0305` Request headers Referer https://nbglogin.xyz/cf0cd/src/style5.css Origin https://nbglogin.xyz Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Fri, 11 Mar 2022 09:08:29 GMT last-modified Fri, 11 Mar 2022 07:16:18 GMT server nginx x-powered-by PleskLin etag "622af742-17118" content-type font/woff2 accept-ranges bytes content-length 94488
GET H2	200	ibredesign.f0ceac6f3471ca7186d40de1d3e2f374.woff nbglogin.xyz/cf0cd/src/images/	10 KB 10 KB	785ms 784ms	Font application/font-woff	107.175.240.161 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Full URL https://nbglogin.xyz/cf0cd/src/images/ibredesign.f0ceac6f3471ca7186d40de1d3e2f374.woff Requested by Host: nbglogin.xyz URL: https://nbglogin.xyz/cf0cd/src/style5.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.175.240.161 , United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS 107-175-240-161-host.colocrossing.com Software nginx / PleskLin Resource Hash `7eaddeb2eaff03e45ce46c2b46ebce3739fa54c7ccad58a640ca4f819eac5ef2` Request headers Referer https://nbglogin.xyz/cf0cd/src/style5.css Origin https://nbglogin.xyz Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Fri, 11 Mar 2022 09:08:29 GMT last-modified Fri, 11 Mar 2022 07:16:19 GMT server nginx x-powered-by PleskLin etag "622af743-2730" content-type application/font-woff accept-ranges bytes content-length 10032
GET H2	200	PFDinDisplayPro-Regular.840952ed9468a2c7444f89b6f748e734.woff2 nbglogin.xyz/cf0cd/src/images/	87 KB 87 KB	1067ms 1067ms	Font font/woff2	107.175.240.161 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Full URL https://nbglogin.xyz/cf0cd/src/images/PFDinDisplayPro-Regular.840952ed9468a2c7444f89b6f748e734.woff2 Requested by Host: nbglogin.xyz URL: https://nbglogin.xyz/cf0cd/src/style5.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.175.240.161 , United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS 107-175-240-161-host.colocrossing.com Software nginx / PleskLin Resource Hash `7a95f0a36d31f363f9789ef519f3c11b63b5ae3dc51d0a26bced8af0c1bd001d` Request headers Referer https://nbglogin.xyz/cf0cd/src/style5.css Origin https://nbglogin.xyz Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Fri, 11 Mar 2022 09:08:29 GMT last-modified Fri, 11 Mar 2022 07:16:19 GMT server nginx x-powered-by PleskLin etag "622af743-15cf0" content-type font/woff2 accept-ranges bytes content-length 89328

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: National Bank of Greece (Banking)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://nbglogin.xyz/cf0cd/src/css/images/PFDinDisplayPro-Light.23cdddacd0d56977093551f2faea9a13.woff2 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://nbglogin.xyz/cf0cd/src/css/images/PFDinDisplayPro-Regular.840952ed9468a2c7444f89b6f748e734.woff2 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://nbglogin.xyz/cf0cd/src/css/images/PFDinDisplayPro-Light.9a5171a196de11651813859c360f195f.woff Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://nbglogin.xyz/cf0cd/src/css/images/PFDinDisplayPro-Regular.21be48ba435316c8a4cd39438cd89083.woff Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

nbglogin.xyz
107.175.240.161
161761d367e7686d40033c1a0daeb88006e9e90b676c3e1368362748a2791fda
657bea5fc93d3f34725e07ac72fd20201673054ebe4e88507efee5b8331d0305
724be1d544d3f4044e97e8e515f23c0f33f08e96e421021c6729947e62f10642
7583021663983a838e88f47a0721d751a51a302d45c69595780c083cd2e99909
7a95f0a36d31f363f9789ef519f3c11b63b5ae3dc51d0a26bced8af0c1bd001d
7eaddeb2eaff03e45ce46c2b46ebce3739fa54c7ccad58a640ca4f819eac5ef2
8c01c5706f7475376c8944119f0992c102311fb459db401bd27467819fa87f46
909457e7d2ab71d52c2fa3386917fee5031be62e179b01804940a6cc9f5d61ac
91dc715405d0bb25103890b512621749faeacf1fb13299fbda4eac81f15e7cab
9ffdc3a68b780337a39d808139258907be67d951cc439a149443e4da7b36129e
a2f2447ea2c696232412fb46b12c8344dc93740b712a8689d324031e0428beb2
a7291d2136d459077949df2e28734f6307acd3b245d20e8958b07dfd81f23951
ab9872644e58c312c6c45df79fd68e005b03423385801e0689d96cadbd0620bb
b6a641e96d081785173e64c24b36a0b3828c2b4ca65c82b872edcd0a5a3eb4b3
cb1ed1360b852f14f1d857fc736f7447167aabcb21f91a3a142179e31158ade5
d01323b878d66d88ef695648887461a1f3843853b8afea91f121483a0512f34d
d6497465709e16d6be1151fc014554b415f7b355024cec20e6a450bf6ab2cbd2
d9bc18485c9c735a09443571ddefdff250e8c9cc72e80557253eb3e43f1e6ae9
eee0de974dc453065f99ef24913aad33ed87c19841d8b1269786e27378fcb53b

nbglogin.xyz Open in urlscan Pro 107.175.240.161 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

23 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

922 kBTransfer

927 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

23 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

0 Cookies

4 Console Messages

Indicators

nbglogin.xyz Open in urlscan Pro
107.175.240.161 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

23
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

922 kB
Transfer

927 kB
Size

0
Cookies

23 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!