santander-alerts.com Open in urlscan Pro
45.91.8.157 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://santander-alerts.com/
Submission: On July 03 via api (July 3rd 2022, 11:30:36 am UTC) from GB — Scanned from GB

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 12 HTTP transactions. The main IP is 45.91.8.157, located in Russian Federation and belongs to SPRINTHOST, RU. The main domain is santander-alerts.com.

This is the only time santander-alerts.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Santander (Banking)

Domain & IP information

	IP Address		AS Autonomous System
12	45.91.8.157 45.91.8.157		35278 (SPRINTHOST) (SPRINTHOST)
12	1

12 45.91.8.157 (Russian Federation)

ASN35278 (SPRINTHOST, RU)

santander-alerts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	santander-alerts.com santander-alerts.com	387 KB
12	1

	Domain	Requested by
12	santander-alerts.com	santander-alerts.com
12	1

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://santander-alerts.com/
Frame ID: A4BEB14C8C61BE30AC2E3FE8C5EA7FC5
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Personal Online Banking: Log on or sign up

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

387 kB
Transfer

621 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response santander-alerts.com/	25 KB 5 KB	1047ms 121ms	Document text/html	45.91.8.157 SPRINTHOST
General Check archive.org Show headers Download Go to Full URL http://santander-alerts.com/ Protocol HTTP/1.1 Server 45.91.8.157 , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software nginx / PHP/7.2.34 Resource Hash `9a9b44ad9c19ded6df7ed6debc778a33515a4494a89bd39f910f28b583494b73` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36 accept-language en-GB,en;q=0.9 Response headers Cache-Control no-store, no-cache, must-revalidate Connection close Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Sun, 03 Jul 2022 11:30:32 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Pragma no-cache Server nginx Transfer-Encoding chunked Vary Accept-Encoding X-Powered-By PHP/7.2.34
GET H/1.1	200 OK	styles.css santander-alerts.com/assets/css/	181 KB 29 KB	209ms 115ms	Stylesheet text/css	45.91.8.157 SPRINTHOST
General Check archive.org Show headers Download Go to Full URL http://santander-alerts.com/assets/css/styles.css Requested by Host: santander-alerts.com URL: http://santander-alerts.com/ Protocol HTTP/1.1 Server 45.91.8.157 , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software nginx / Resource Hash `cb84575e7d02ca7ba09f08e3c6481aca4664f5d708793178db0ff9ddf6528c23` Request headers accept-language en-GB,en;q=0.9 Referer http://santander-alerts.com/ User-Agent Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36 Response headers Date Sun, 03 Jul 2022 11:30:32 GMT Content-Encoding gzip Last-Modified Mon, 10 Aug 2020 22:50:40 GMT Server nginx ETag W/"5f31cf40-2d58d" Vary Accept-Encoding Content-Type text/css Cache-Control max-age=315360000 Transfer-Encoding chunked Connection close Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	header-logo.png santander-alerts.com/assets/images/	3 KB 3 KB	236ms 119ms	Image image/png	45.91.8.157 SPRINTHOST
General Check archive.org Show headers Download Go to Show image Full URL http://santander-alerts.com/assets/images/header-logo.png Requested by Host: santander-alerts.com URL: http://santander-alerts.com/ Protocol HTTP/1.1 Server 45.91.8.157 , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software nginx / Resource Hash `f700c3638638b62b07e614c8cae5665cf4bfa956452ab4e6fea5a15965fc40f7` Request headers accept-language en-GB,en;q=0.9 Referer http://santander-alerts.com/ User-Agent Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36 Response headers Date Sun, 03 Jul 2022 11:30:32 GMT Last-Modified Mon, 10 Aug 2020 22:50:40 GMT Server nginx ETag "5f31cf40-aeb" Content-Type image/png Cache-Control max-age=315360000 Connection close Accept-Ranges bytes Content-Length 2795 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	asset-3-3-x.png santander-alerts.com/assets/images/	35 KB 35 KB	219ms 125ms	Image image/png	45.91.8.157 SPRINTHOST
General Check archive.org Show headers Download Go to Show image Full URL http://santander-alerts.com/assets/images/asset-3-3-x.png Requested by Host: santander-alerts.com URL: http://santander-alerts.com/ Protocol HTTP/1.1 Server 45.91.8.157 , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software nginx / Resource Hash `3a1b7863c59caf1cb8c5e14792598b1504b15072ed91aac22d7b45e06e924c02` Request headers accept-language en-GB,en;q=0.9 Referer http://santander-alerts.com/ User-Agent Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36 Response headers Date Sun, 03 Jul 2022 11:30:32 GMT Last-Modified Mon, 10 Aug 2020 22:50:40 GMT Server nginx ETag "5f31cf40-8a18" Content-Type image/png Cache-Control max-age=315360000 Connection close Accept-Ranges bytes Content-Length 35352 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	asset-2.png santander-alerts.com/assets/images/	3 KB 4 KB	222ms 126ms	Image image/png	45.91.8.157 SPRINTHOST
General Check archive.org Show headers Download Go to Show image Full URL http://santander-alerts.com/assets/images/asset-2.png Requested by Host: santander-alerts.com URL: http://santander-alerts.com/ Protocol HTTP/1.1 Server 45.91.8.157 , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software nginx / Resource Hash `1bca034dc76dab33232d41f7f9705fced08c4b48c90e23bd737e4b610d1b6df8` Request headers accept-language en-GB,en;q=0.9 Referer http://santander-alerts.com/ User-Agent Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36 Response headers Date Sun, 03 Jul 2022 11:30:32 GMT Last-Modified Mon, 10 Aug 2020 22:50:40 GMT Server nginx ETag "5f31cf40-df1" Content-Type image/png Cache-Control max-age=315360000 Connection close Accept-Ranges bytes Content-Length 3569 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	jquery-1.11.3.min.js Show response santander-alerts.com/assets/js/	94 KB 33 KB	209ms 135ms	Script application/javascript	45.91.8.157 SPRINTHOST
General Check archive.org Show headers Download Go to Full URL http://santander-alerts.com/assets/js/jquery-1.11.3.min.js Requested by Host: santander-alerts.com URL: http://santander-alerts.com/ Protocol HTTP/1.1 Server 45.91.8.157 , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software nginx / Resource Hash `ecb916133a9376911f10bc5c659952eb0031e457f5df367cde560edbfba38fb8` Request headers accept-language en-GB,en;q=0.9 Referer http://santander-alerts.com/ User-Agent Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36 Response headers Date Sun, 03 Jul 2022 11:30:32 GMT Content-Encoding gzip Last-Modified Mon, 10 Aug 2020 22:50:40 GMT Server nginx ETag W/"5f31cf40-176d5" Vary Accept-Encoding Content-Type application/javascript Cache-Control max-age=315360000 Transfer-Encoding chunked Connection close Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	main.js Show response santander-alerts.com/assets/js/	5 KB 2 KB	221ms 128ms	Script application/javascript	45.91.8.157 SPRINTHOST
General Check archive.org Show headers Download Go to Full URL http://santander-alerts.com/assets/js/main.js Requested by Host: santander-alerts.com URL: http://santander-alerts.com/ Protocol HTTP/1.1 Server 45.91.8.157 , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software nginx / Resource Hash `3b8417b65ac98cfd189ae1e119901e3de8d2aca9c9cd87ed4568271d94b27d64` Request headers accept-language en-GB,en;q=0.9 Referer http://santander-alerts.com/ User-Agent Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36 Response headers Date Sun, 03 Jul 2022 11:30:32 GMT Content-Encoding gzip Last-Modified Mon, 10 Aug 2020 22:50:40 GMT Server nginx ETag W/"5f31cf40-1256" Vary Accept-Encoding Content-Type application/javascript Cache-Control max-age=315360000 Transfer-Encoding chunked Connection close Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	SantanderTextW05-Regular.77501c6e88280139f847.ttf santander-alerts.com/assets/fonts/	138 KB 138 KB	203ms 110ms	Font application/octet-stream	45.91.8.157 SPRINTHOST
General Check archive.org Show headers Download Go to Full URL http://santander-alerts.com/assets/fonts/SantanderTextW05-Regular.77501c6e88280139f847.ttf Requested by Host: santander-alerts.com URL: http://santander-alerts.com/assets/css/styles.css Protocol HTTP/1.1 Server 45.91.8.157 , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software nginx / Resource Hash `3c34b516dc489a5ff3cb121a73b6cfc25ec0920394b2d3b742d30201e71e6e24` Request headers Referer http://santander-alerts.com/assets/css/styles.css Origin http://santander-alerts.com accept-language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36 Response headers Date Sun, 03 Jul 2022 11:30:32 GMT Last-Modified Mon, 10 Aug 2020 22:50:40 GMT Server nginx ETag "5f31cf40-22788" Content-Type application/octet-stream Cache-Control max-age=315360000 Connection close Accept-Ranges bytes Content-Length 141192 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	SantanderHeadlineW05-Rg.838addf7f1e08ecb31f9.ttf santander-alerts.com/assets/fonts/	138 KB 138 KB	201ms 108ms	Font application/octet-stream	45.91.8.157 SPRINTHOST
General Check archive.org Show headers Download Go to Full URL http://santander-alerts.com/assets/fonts/SantanderHeadlineW05-Rg.838addf7f1e08ecb31f9.ttf Requested by Host: santander-alerts.com URL: http://santander-alerts.com/assets/css/styles.css Protocol HTTP/1.1 Server 45.91.8.157 , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software nginx / Resource Hash `cf2166ed0037c6f2797c0774063ecc0275cd08473aeff74cf79dc510bb60398b` Request headers Referer http://santander-alerts.com/assets/css/styles.css Origin http://santander-alerts.com accept-language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36 Response headers Date Sun, 03 Jul 2022 11:30:32 GMT Last-Modified Mon, 10 Aug 2020 22:50:40 GMT Server nginx ETag "5f31cf40-2275c" Content-Type application/octet-stream Cache-Control max-age=315360000 Connection close Accept-Ranges bytes Content-Length 141148 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	action.php Show response santander-alerts.com/admin/inc/	0 285 B	224ms 127ms	XHR text/html	45.91.8.157 SPRINTHOST
General Check archive.org Show headers Download Go to Full URL http://santander-alerts.com/admin/inc/action.php?type=ping Requested by Host: santander-alerts.com URL: http://santander-alerts.com/assets/js/jquery-1.11.3.min.js Protocol HTTP/1.1 Server 45.91.8.157 , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software nginx / PHP/7.2.34 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept / Referer http://santander-alerts.com/ X-Requested-With XMLHttpRequest accept-language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36 Response headers Pragma no-cache Date Sun, 03 Jul 2022 11:30:33 GMT Server nginx X-Powered-By PHP/7.2.34 Content-Type text/html; charset=UTF-8 Cache-Control no-store, no-cache, must-revalidate Connection close Content-Length 0 Expires Thu, 19 Nov 1981 08:52:00 GMT
GET H/1.1	200 OK	action.php Show response santander-alerts.com/admin/inc/	0 285 B	213ms 118ms	XHR text/html	45.91.8.157 SPRINTHOST
General Check archive.org Show headers Download Go to Full URL http://santander-alerts.com/admin/inc/action.php?type=ping Requested by Host: santander-alerts.com URL: http://santander-alerts.com/assets/js/jquery-1.11.3.min.js Protocol HTTP/1.1 Server 45.91.8.157 , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software nginx / PHP/7.2.34 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept / Referer http://santander-alerts.com/ X-Requested-With XMLHttpRequest accept-language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36 Response headers Pragma no-cache Date Sun, 03 Jul 2022 11:30:34 GMT Server nginx X-Powered-By PHP/7.2.34 Content-Type text/html; charset=UTF-8 Cache-Control no-store, no-cache, must-revalidate Connection close Content-Length 0 Expires Thu, 19 Nov 1981 08:52:00 GMT
GET H/1.1	200 OK	action.php Show response santander-alerts.com/admin/inc/	0 285 B	212ms 115ms	XHR text/html	45.91.8.157 SPRINTHOST
General Check archive.org Show headers Download Go to Full URL http://santander-alerts.com/admin/inc/action.php?type=ping Requested by Host: santander-alerts.com URL: http://santander-alerts.com/assets/js/jquery-1.11.3.min.js Protocol HTTP/1.1 Server 45.91.8.157 , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software nginx / PHP/7.2.34 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept / Referer http://santander-alerts.com/ X-Requested-With XMLHttpRequest accept-language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36 Response headers Pragma no-cache Date Sun, 03 Jul 2022 11:30:35 GMT Server nginx X-Powered-By PHP/7.2.34 Content-Type text/html; charset=UTF-8 Cache-Control no-store, no-cache, must-revalidate Connection close Content-Length 0 Expires Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Santander (Banking)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			santander-alerts.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: g0oisevrse3net5j3i04g685gh

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

santander-alerts.com
45.91.8.157
1bca034dc76dab33232d41f7f9705fced08c4b48c90e23bd737e4b610d1b6df8
3a1b7863c59caf1cb8c5e14792598b1504b15072ed91aac22d7b45e06e924c02
3b8417b65ac98cfd189ae1e119901e3de8d2aca9c9cd87ed4568271d94b27d64
3c34b516dc489a5ff3cb121a73b6cfc25ec0920394b2d3b742d30201e71e6e24
9a9b44ad9c19ded6df7ed6debc778a33515a4494a89bd39f910f28b583494b73
cb84575e7d02ca7ba09f08e3c6481aca4664f5d708793178db0ff9ddf6528c23
cf2166ed0037c6f2797c0774063ecc0275cd08473aeff74cf79dc510bb60398b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ecb916133a9376911f10bc5c659952eb0031e457f5df367cde560edbfba38fb8
f700c3638638b62b07e614c8cae5665cf4bfa956452ab4e6fea5a15965fc40f7

santander-alerts.com Open in urlscan Pro 45.91.8.157 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

12 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

387 kBTransfer

621 kBSize

1 Cookies

0 Outgoing links

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

15 JavaScript Global Variables

1 Cookies

Indicators

santander-alerts.com Open in urlscan Pro
45.91.8.157 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

387 kB
Transfer

621 kB
Size

1
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!