haireleganceutah.com
Open in
urlscan Pro
209.59.191.190
Malicious Activity!
Public Scan
Effective URL: https://haireleganceutah.com/ntc/natwest3/mobile/login.php
Submission: On May 28 via api from US — Scanned from DE
Summary
TLS certificate: Issued by R3 on April 5th 2024. Valid for: 3 months.
This is the only time haireleganceutah.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: NatWest (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
27 | 209.59.191.190 209.59.191.190 | 32244 (LIQUIDWEB) (LIQUIDWEB) | |
27 | 1 |
ASN32244 (LIQUIDWEB, US)
PTR: alt2-dory.exacthosting.com
haireleganceutah.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
27 |
haireleganceutah.com
haireleganceutah.com |
465 KB |
27 | 1 |
Domain | Requested by | |
---|---|---|
27 | haireleganceutah.com |
haireleganceutah.com
|
27 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.haireleganceutah.com R3 |
2024-04-05 - 2024-07-04 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://haireleganceutah.com/ntc/natwest3/mobile/login.php
Frame ID: FDEF50CF1336B48A306304CA3E9C1637
Requests: 3 HTTP requests in this frame
Frame:
https://haireleganceutah.com/ntc/natwest3/mobile/login_files/login.php
Frame ID: FE4CD48B4101ACE12E0C9681406E1429
Requests: 24 HTTP requests in this frame
Screenshot
Page Title
Log in to Online Î’ankingPage URL History Show full URLs
-
http://haireleganceutah.com/ntc/natwest3/mobile/login.php
HTTP 307
https://haireleganceutah.com/ntc/natwest3/mobile/login.php Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://haireleganceutah.com/ntc/natwest3/mobile/login.php
HTTP 307
https://haireleganceutah.com/ntc/natwest3/mobile/login.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
27 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
login.php
haireleganceutah.com/ntc/natwest3/mobile/ Redirect Chain
|
849 B 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.php
haireleganceutah.com/ntc/natwest3/mobile/login_files/ Frame FE4C |
26 KB 26 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
master.css
haireleganceutah.com/ntc/natwest3/mobile/login_files/ Frame FE4C |
133 KB 133 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
datePicker.css
haireleganceutah.com/ntc/natwest3/mobile/login_files/ Frame FE4C |
2 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
npc.css
haireleganceutah.com/ntc/natwest3/mobile/login_files/ Frame FE4C |
46 KB 47 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
overlayPromptMaster.css
haireleganceutah.com/ntc/natwest3/mobile/login_files/ Frame FE4C |
2 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
overlayPrompt.css
haireleganceutah.com/ntc/natwest3/mobile/login_files/ Frame FE4C |
76 B 316 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
master_mobile.css
haireleganceutah.com/ntc/natwest3/mobile/login_files/ Frame FE4C |
18 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ScriptCombiner.js
haireleganceutah.com/ntc/natwest3/mobile/login_files/ Frame FE4C |
110 KB 110 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
haireleganceutah.com/ntc/natwest3/mobile/login_files/ Frame FE4C |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
NPC_auralstyle.css
haireleganceutah.com/ntc/natwest3/mobile/login_files/ Frame FE4C |
515 B 756 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
master_print.css
haireleganceutah.com/ntc/natwest3/mobile/login_files/ Frame FE4C |
5 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
LI5_tabA.gif
haireleganceutah.com/ntc/natwest3/mobile/login_files/ Frame FE4C |
1 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
LI5_tabB.gif
haireleganceutah.com/ntc/natwest3/mobile/login_files/ Frame FE4C |
2 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
error-marker.png
haireleganceutah.com/ntc/natwest3/mobile/login_files/ Frame FE4C |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
security.gif
haireleganceutah.com/ntc/natwest3/mobile/login_files/ Frame FE4C |
6 KB 6 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
loginWithCardPAN.js
haireleganceutah.com/ntc/natwest3/mobile/login_files/ Frame FE4C |
44 KB 44 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
white-lock.png
haireleganceutah.com/ntc/natwest3/mobile/login_files/ Frame FE4C |
285 B 527 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
alert.png
haireleganceutah.com/ntc/natwest3/mobile/login_files/ Frame FE4C |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
radio-normal.png
haireleganceutah.com/ntc/natwest3/mobile/login_files/ Frame FE4C |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
down-chevron.png
haireleganceutah.com/ntc/natwest3/mobile/login_files/ Frame FE4C |
295 B 537 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
right-chevron.png
haireleganceutah.com/ntc/natwest3/mobile/login_files/ Frame FE4C |
314 B 556 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
RNHouseSansW03-Bold.woff
haireleganceutah.com/ntc/natwest3/mobile/login_files/ Frame FE4C |
26 KB 26 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
RNHouseSansW03-Regular.woff
haireleganceutah.com/ntc/natwest3/mobile/login_files/ Frame FE4C |
25 KB 25 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
radio-selected.png
haireleganceutah.com/ntc/natwest3/mobile/login_files/ Frame FE4C |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.ico
haireleganceutah.com/ntc/natwest3/mobile/login_files/ |
2 KB 2 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.ico
haireleganceutah.com/ntc/natwest3/mobile/login_files/ |
2 KB 0 |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: NatWest (Banking)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 00 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
haireleganceutah.com
209.59.191.190
04c45c81e1298e703f3bde9cec27446450294330ae06bd24c9f9343b264462e9
11293bc48d17705e665ec64a00f9281e1b9cc63c17d4d1e75cb1020d8de33660
1170c4dcd75aa4be6e54f2ecce07403f56f30fc36db02ac34d2a0f4e1edf8c5f
14714f651128eff786763144294b0e7c67529d317ac5371632bbf8fb659866ff
170ff622c2facefbcf7c4bccdbe818d0ec06444c7c2eba6b2a1a7f751bc6125f
1acd7d03edc5d90866fd012355c352efbb02f38c9334cffd4a9f321b4d713491
1ec277d20cb0b2b9d72322f3cc32d988435978a6a8f72b28e0f8ac8b1bf17a72
23d5df83d5a429e895043a5ce3b11b682e3d0b182d1032b89b0596de272f1a7e
27f324f2ad60091d5e8f76adfef83f9122dc8aa8df29d0a8d970bfe06aaa5005
37539c1b025b1580975ce7942ff711e4e92e6f549af893e46e5a9a60e705c02c
43602a08028630c8a77fb24d48ef25686d736ddf3c8400b834502fcdedea8d88
4f5a022467e927b5b385cc335e58434a49bad0520ed018fc059075069d695c79
643d4d52a1a24515822f6a30683f901bb5dd16c251d88caece27ab2713457272
6ef50f168430fe859b5ee6aae7fa42302e739147f9837f573b0e45447914d073
7686c35ca03a4af5669967f533e34abd1e0e0c50c1240daa7d1c86aad9dc4bd3
8580c2293c3da84700196ef73b13efbd37130887317f497a6bf75583956aac13
8d19ce7511c97d861471b938de9d7a3375599c0326f5ea6d72a362ebbded1bcd
917942589e5b140755ee83bb4720ca9c1bbf7705f44f51a78ba1ffa635420c50
9bbf91204e8022d01c859c92c1d9218ac4859de521548856534b48ac2e7849a8
b465d00b89619e9899ec7d618559157db09f935d318466d67deb036157fadcf2
ce87bf8a3058e5028a4b64dc0aa16e0614f7e47d87223594c6353450aadbf5ad
d6f01bdb67a342b50dacb894a4cc585dbe700da9dd373886ade1480113972cc1
d81db57832f4742b67755f90f8c3d37735cb9f58dbb10e312f931343d27552c6
e3c202c787d4eef5e65ab55ba52edc7113255175d2615a674e59f19ff26bc6fe
e4a1b9628a61642629299077aa8074e3ee6b280d397efa0d7220c7b09efe8522
ef7db794b4a6b5c42d2535919d91fb11da1e5cd1147f35196db382197b35fdee