www.direct-accountreview.co Open in urlscan Pro
66.29.137.42  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
3 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.direct-accountreview.co/	8 KB 3 KB	500ms 170ms	Document text/html	66.29.137.42 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://www.direct-accountreview.co/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 66.29.137.42 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium207-3.web-hosting.com Software Apache / PHP/7.2.34 Resource Hash fbbe085368ae9f7a5f90abc49f9c0de98517e253d8b6193e9c3092316d0e8738 Request headers :method GET :authority www.direct-accountreview.co :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 18 Jun 2021 16:58:56 GMT server Apache x-powered-by PHP/7.2.34 expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate pragma no-cache set-cookie PHPSESSID=4dd1f5460727eaf795ca79cf920d62dd; path=/ vary Accept-Encoding content-encoding gzip content-length 2785 content-type text/html; charset=UTF-8
GET H2	200	jquery.js Show response www.direct-accountreview.co/js/	87 KB 30 KB	313ms 313ms	Script application/javascript	66.29.137.42 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://www.direct-accountreview.co/js/jquery.js Requested by Host: www.direct-accountreview.co URL: https://www.direct-accountreview.co/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 66.29.137.42 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium207-3.web-hosting.com Software Apache / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Request headers :path /js/jquery.js pragma no-cache cookie PHPSESSID=4dd1f5460727eaf795ca79cf920d62dd accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority www.direct-accountreview.co referer https://www.direct-accountreview.co/ :scheme https sec-fetch-site same-origin :method GET Referer https://www.direct-accountreview.co/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 18 Jun 2021 16:58:57 GMT content-encoding gzip last-modified Thu, 20 May 2021 10:31:40 GMT server Apache vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 30902
GET H/1.1	200 OK	app.1.16.0.223bc6.css www1.firstdirect.com/etc/designs/fsdt/online/	296 KB 51 KB	634ms 73ms	Stylesheet text/css	193.108.75.102 HSBC-UK
General Check archive.org Show headers Download Go to Full URL https://www1.firstdirect.com/etc/designs/fsdt/online/app.1.16.0.223bc6.css Requested by Host: www.direct-accountreview.co URL: https://www.direct-accountreview.co/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 193.108.75.102 Glossop, United Kingdom, ASN20705 (HSBC-UK, GB), Reverse DNS Software Apache / Resource Hash 55f0365e894f57905028d8ff792adbf42b61abd0694918f8927df9f753eef755 Security Headers Name Value Strict-Transport-Security max-age=16070400; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://www.direct-accountreview.co/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Fri, 18 Jun 2021 16:58:57 GMT Content-Encoding gzip X-Content-Type-Options nosniff Last-Modified Fri, 11 Jun 2021 09:20:23 GMT Server Apache Vary Accept-Encoding Strict-Transport-Security max-age=16070400; includeSubDomains Content-Type text/css Cache-Control max-age=31536000 Connection Keep-Alive Accept-Ranges bytes S gbl-prod-sy-aempub Keep-Alive timeout=5, max=100 Content-Length 51600 X-XSS-Protection 1; mode=block
GET DATA	200 OK	truncated /	6 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 70b9e003edf061263b00b0cf2b30457ed3c6e8e843a663467aa540b0c1c9cb85 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8
GET DATA	200 OK	truncated /	6 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash ff494e63dbf65d514f4082ee6e1518b8d95a14fd6b9c7e7ad8aa2ea71c32dc21 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8
GET DATA	200 OK	truncated /	158 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash abe5dd4337483083a1525197caceac6b1e229cb02b6334b41040a2e9ef1edd1b Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8
GET H/1.1	200 OK	HelveticaNeueLTW05-45Light.woff2 www1.firstdirect.com/etc/designs/fsdt/common/fonts/	38 KB 38 KB	120ms 37ms	Font application/font-woff2	193.108.75.102 HSBC-UK
General Check archive.org Show headers Download Go to Full URL https://www1.firstdirect.com/etc/designs/fsdt/common/fonts/HelveticaNeueLTW05-45Light.woff2 Requested by Host: www1.firstdirect.com URL: https://www1.firstdirect.com/etc/designs/fsdt/online/app.1.16.0.223bc6.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 193.108.75.102 Glossop, United Kingdom, ASN20705 (HSBC-UK, GB), Reverse DNS Software Apache / Resource Hash 0bfe845c97897526fcfd1009a71c12de5b8f85115c339cc5483234ac3a1a97ca Security Headers Name Value Strict-Transport-Security max-age=16070400; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Origin https://www.direct-accountreview.co Referer https://www1.firstdirect.com/etc/designs/fsdt/online/app.1.16.0.223bc6.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Fri, 18 Jun 2021 16:58:57 GMT X-Content-Type-Options nosniff Last-Modified Fri, 11 Jun 2021 09:19:27 GMT Server Apache Strict-Transport-Security max-age=16070400; includeSubDomains Content-Type application/font-woff2 Access-Control-Allow-Origin * Cache-Control max-age=7776000 Connection Keep-Alive Accept-Ranges bytes S gbl-prod-sy-aempub Keep-Alive timeout=5, max=100 Content-Length 38476 X-XSS-Protection 1; mode=block
GET H/1.1	200 OK	HelveticaNeueLTW05-75Bold.woff2 www1.firstdirect.com/etc/designs/fsdt/common/fonts/	41 KB 42 KB	121ms 38ms	Font application/font-woff2	193.108.75.102 HSBC-UK
General Check archive.org Show headers Download Go to Full URL https://www1.firstdirect.com/etc/designs/fsdt/common/fonts/HelveticaNeueLTW05-75Bold.woff2 Requested by Host: www1.firstdirect.com URL: https://www1.firstdirect.com/etc/designs/fsdt/online/app.1.16.0.223bc6.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 193.108.75.102 Glossop, United Kingdom, ASN20705 (HSBC-UK, GB), Reverse DNS Software Apache / Resource Hash 55ade691f1a06265b6e9c502523ea2972ff8432f2ef1766965d9b3d3bbdd7d81 Security Headers Name Value Strict-Transport-Security max-age=16070400; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Origin https://www.direct-accountreview.co Referer https://www1.firstdirect.com/etc/designs/fsdt/online/app.1.16.0.223bc6.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Fri, 18 Jun 2021 16:58:57 GMT X-Content-Type-Options nosniff Last-Modified Fri, 11 Jun 2021 09:19:16 GMT Server Apache Strict-Transport-Security max-age=16070400; includeSubDomains Content-Type application/font-woff2 Access-Control-Allow-Origin * Cache-Control max-age=7776000 Connection Keep-Alive Accept-Ranges bytes S gbl-prod-sy-aempub Keep-Alive timeout=5, max=100 Content-Length 42012 X-XSS-Protection 1; mode=block
GET H/1.1	200 OK	HelveticaNeueLTW05-85Heavy.woff2 www1.firstdirect.com/etc/designs/fsdt/common/fonts/	39 KB 39 KB	129ms 41ms	Font application/font-woff2	193.108.75.102 HSBC-UK
General Check archive.org Show headers Download Go to Full URL https://www1.firstdirect.com/etc/designs/fsdt/common/fonts/HelveticaNeueLTW05-85Heavy.woff2 Requested by Host: www1.firstdirect.com URL: https://www1.firstdirect.com/etc/designs/fsdt/online/app.1.16.0.223bc6.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 193.108.75.102 Glossop, United Kingdom, ASN20705 (HSBC-UK, GB), Reverse DNS Software Apache / Resource Hash 5a91f20f8988e1e9f8f30601e48a6996725a7fd3ab2e5f2e854393b33ccc4c4e Security Headers Name Value Strict-Transport-Security max-age=16070400; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Origin https://www.direct-accountreview.co Referer https://www1.firstdirect.com/etc/designs/fsdt/online/app.1.16.0.223bc6.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Fri, 18 Jun 2021 16:58:57 GMT X-Content-Type-Options nosniff Last-Modified Fri, 11 Jun 2021 09:19:18 GMT Server Apache Strict-Transport-Security max-age=16070400; includeSubDomains Content-Type application/font-woff2 Access-Control-Allow-Origin * Cache-Control max-age=7776000 Connection Keep-Alive Accept-Ranges bytes S gbl-prod-sy-aempub Keep-Alive timeout=5, max=100 Content-Length 39460 X-XSS-Protection 1; mode=block

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: first direct bank (Banking)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.direct-accountreview.co/	1969-12-31 23:59:59	Name: PHPSESSID Value: 4dd1f5460727eaf795ca79cf920d62dd

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.direct-accountreview.co
www1.firstdirect.com
193.108.75.102
66.29.137.42
0bfe845c97897526fcfd1009a71c12de5b8f85115c339cc5483234ac3a1a97ca
55ade691f1a06265b6e9c502523ea2972ff8432f2ef1766965d9b3d3bbdd7d81
55f0365e894f57905028d8ff792adbf42b61abd0694918f8927df9f753eef755
5a91f20f8988e1e9f8f30601e48a6996725a7fd3ab2e5f2e854393b33ccc4c4e
70b9e003edf061263b00b0cf2b30457ed3c6e8e843a663467aa540b0c1c9cb85
abe5dd4337483083a1525197caceac6b1e229cb02b6334b41040a2e9ef1edd1b
fbbe085368ae9f7a5f90abc49f9c0de98517e253d8b6193e9c3092316d0e8738
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
ff494e63dbf65d514f4082ee6e1518b8d95a14fd6b9c7e7ad8aa2ea71c32dc21