ib.nab.com.au.account-2fa.ga
Open in
urlscan Pro
212.92.98.71
Malicious Activity!
Public Scan
Submission: On April 06 via automatic, source openphish
Summary
This is the only time ib.nab.com.au.account-2fa.ga was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: NAB Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
28 | 212.92.98.71 212.92.98.71 | 49505 (SELECTEL) (SELECTEL) | |
28 | 1 |
ASN49505 (SELECTEL, RU)
ib.nab.com.au.account-2fa.ga | |
gotyoubro.ml |
Apex Domain Subdomains |
Transfer | |
---|---|---|
25 |
account-2fa.ga
ib.nab.com.au.account-2fa.ga |
141 KB |
3 |
gotyoubro.ml
gotyoubro.ml |
975 B |
28 | 2 |
Domain | Requested by | |
---|---|---|
25 | ib.nab.com.au.account-2fa.ga |
ib.nab.com.au.account-2fa.ga
|
3 | gotyoubro.ml |
ib.nab.com.au.account-2fa.ga
|
28 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://ib.nab.com.au.account-2fa.ga/2b50d24a79fdf9d7ce203a19564b5006/login/
Frame ID: D0E0F6A50630F25122BEE3F77D736E7D
Requests: 28 HTTP requests in this frame
Screenshot
Detected technologies
Nginx (Web Servers) ExpandDetected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Font Awesome (Font Scripts) Expand
Detected patterns
- html /<link[^>]* href=[^>]+font-awesome(?:\.min)?\.css/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery.*\.js/i
- env /^jQuery$/i
Twitter Bootstrap () Expand
Detected patterns
- html /<link[^>]+?href="[^"]+bootstrap(?:\.min)?\.css/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
28 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
ib.nab.com.au.account-2fa.ga/2b50d24a79fdf9d7ce203a19564b5006/login/ |
12 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
index.css
ib.nab.com.au.account-2fa.ga/login/ |
17 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
font-awesome.min.css
ib.nab.com.au.account-2fa.ga/bower_components/font-awesome/css/ |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
ib.nab.com.au.account-2fa.ga/bower_components/jquery/dist/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
css.css
ib.nab.com.au.account-2fa.ga/login/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
form.js
ib.nab.com.au.account-2fa.ga/login/ |
6 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
token.js
ib.nab.com.au.account-2fa.ga/login/ |
7 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
image_item45.png
ib.nab.com.au.account-2fa.ga/login/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
image_item46.gif
ib.nab.com.au.account-2fa.ga/login/ |
3 KB 3 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
image_item37.gif
ib.nab.com.au.account-2fa.ga/login/ |
68 B 308 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
image_item32.gif
ib.nab.com.au.account-2fa.ga/login/ |
1 KB 1 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
image_item30.gif
ib.nab.com.au.account-2fa.ga/login/ |
1 KB 1 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
image_item31.gif
ib.nab.com.au.account-2fa.ga/login/ |
449 B 691 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
image_item29.gif
ib.nab.com.au.account-2fa.ga/login/ |
581 B 823 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
image_item36.gif
ib.nab.com.au.account-2fa.ga/login/ |
274 B 516 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
image_item22.jpg
ib.nab.com.au.account-2fa.ga/login/ |
19 KB 19 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
image_item21.gif
ib.nab.com.au.account-2fa.ga/login/ |
100 B 341 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
image_item41.gif
ib.nab.com.au.account-2fa.ga/login/ |
307 B 549 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
image_item39.gif
ib.nab.com.au.account-2fa.ga/login/ |
2 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
image_item34.png
ib.nab.com.au.account-2fa.ga/login/ |
154 B 395 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
corpid-b-webfont_001.woff
ib.nab.com.au.account-2fa.ga/login/ |
25 KB 25 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
corpid-l-webfont_001.woff
ib.nab.com.au.account-2fa.ga/login/ |
27 KB 27 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
image_item23.gif
ib.nab.com.au.account-2fa.ga/login/ |
257 B 499 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dotsfont.woff
ib.nab.com.au.account-2fa.ga/dotfont/ |
2 KB 3 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bins.json
ib.nab.com.au.account-2fa.ga/ |
513 B 489 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tokenII.php
gotyoubro.ml/uadmin/gates/ |
57 B 325 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tokenII.php
gotyoubro.ml/uadmin/gates/ |
57 B 325 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tokenII.php
gotyoubro.ml/uadmin/gates/ |
57 B 325 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: NAB Bank (Banking)30 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| _kaktys_encode string| admin_home string| full_url string| dir_url string| link object| bider_obj string| bb_link object| last_respond undefined| last_operation object| respond string| bid function| cc_proxy__ function| vbv_proxy__ function| login_proxy__ object| cookies function| advanced_string_validation function| sin_luhn function| cc_luhn function| dob_luhn function| exp_luhn function| valid_a function| valid_q function| send1 string| cc object| CORE__ object| REST_FN__ number| bidder_timer object| bins0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
gotyoubro.ml
ib.nab.com.au.account-2fa.ga
212.92.98.71
047532b80749cd876978ef5149876f804837410fbc2ad12b79857f34622e2583
04ff4054aedfdc46f0358f8f145717259c3d264f78837b8eb3bdb46024315947
0be93ba9b93250bde05417c35f0e453cc6ca03b5ad40168b63dd7f419a08a5a2
2ba3f5630fced81ab628aa477e33d59376adc39cd9af7013f4a5cbd74e7ed319
345e5797bde0b78107d25a3ab912482a2009a90dcc37c61e10f04bdf90a5c9e6
38db52c7406151339645f1d9e6642be7e31f97457fad34b541bcee77e58d54ac
3ba0cbe2d94f9fa944686fe35ebe49f27b41ba5386e32443d606885c1c2925ac
40c08695a6bb619ac169d9bdf4f1b0266a5a17bb000fc8bcf77b9ca0a1fc6285
4b0f8a88bea8e8300faf9c6eb50d989aed7b008262dd482f78ed3e340251adc5
4c27e00efc3a284d6406cbe4838292288fd65fb135cb303902e682e7a7a5f473
4f48fca9a73368362a7356a8d3fdcc86b40a174b7b83c80b059a9322d0619e47
56bfc75f11fcec244dfe2f710ffa6ae41797037133402a309e0657a837e5e3f9
680ebc1aecd70eb8791e9fca7d92e873fc94f820c3c22fd38441da7a266db279
740b92b37caf1906cd34828753b3c60f3f92fa7d89c172a757ae8ddb229c413b
77d1ab961937c666446ff7d527d4e676af95509b034d8cc25139a044ed0b0f54
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
8740c4494b7a404a10771da97993b6fee7937220bda2d967b47542f6b499f0ad
9621d8554a3da9ef03ca02a8ad7ba492f872e7a3d47ab6964f6705856c6094cf
a0f7466886559e2f009b59c21c80021e45a6b9911f5e25a6e96879c16b269b72
aded0530b852996f0f6d0bdee146023d096aa2c7990805c8f1f90456172b7892
b59dac6fad9c97244268d80748845bb6efac3bac4999809675e742e21c0cfac4
c4d9a3125d8ae44072e64b39bacde45a74d6157c5d8b7e965b9a919739338e84
c7a299c1e3976b682508aeac5138f2f31b289d350e94bbd3ccc4f7570b67dcd0
c8b5c36b604b175f0c6be6b98f40c5b82c05b0a76aadd383a61b0f4fe0b3d264
eda98811a704e8f1dfe866d334073066238c53706e76034e828a14b8eefca2a5
f4665f92947f2486562df128a7b621a026c0241f296eb3d38ac34191c4dcff5d