sfi.lewiscc.dev Open in urlscan Pro
185.94.235.168 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://sfi.lewiscc.dev/
Submission: On May 02 via api (May 2nd 2024, 12:08:40 pm UTC) from CA — Scanned from US

Summary HTTP 27 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 5 domains to perform 27 HTTP transactions. The main IP is 185.94.235.168, located in United Kingdom and belongs to CONSIDERIT, GB. The main domain is sfi.lewiscc.dev.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on March 6th 2024. Valid for: a year.

This is the only time sfi.lewiscc.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Santander (Banking)

Domain & IP information

	IP Address	AS Autonomous System
16	185.94.235.168 185.94.235.168	47492 (CONSIDERIT) (CONSIDERIT)
2	2606:4700::68... 2606:4700::6810:291c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a04:4e42:400... 2a04:4e42:400::649	54113 (FASTLY) (FASTLY)
6	172.67.70.243 172.67.70.243	13335 (CLOUDFLAR...) (CLOUDFLARENET)
27	5

16 185.94.235.168 (United Kingdom)

ASN47492 (CONSIDERIT, GB)
PTR: 185-94-235-168.ip-space.cit.net.uk

sfi.lewiscc.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:291c (United States)

ASN13335 (CLOUDFLARENET, US)

fast.fonts.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:400::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 172.67.70.243 (United States)

ASN13335 (CLOUDFLARENET, US)

edge.marker.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
api.marker.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
16	lewiscc.dev sfi.lewiscc.dev	1 MB
6	marker.io edge.marker.io — Cisco Umbrella Rank: 38474 api.marker.io — Cisco Umbrella Rank: 37141	191 KB
2	fonts.net fast.fonts.net — Cisco Umbrella Rank: 4137	1 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 776	82 KB
0	santanderforintermediaries.co.uk Failed webchat-staging.santanderforintermediaries.co.uk Failed
27	5

	Domain	Requested by
16	sfi.lewiscc.dev	sfi.lewiscc.dev
4	edge.marker.io	sfi.lewiscc.dev edge.marker.io
2	api.marker.io	edge.marker.io
2	fast.fonts.net	sfi.lewiscc.dev fast.fonts.net
1	code.jquery.com	sfi.lewiscc.dev
0	webchat-staging.santanderforintermediaries.co.uk Failed	sfi.lewiscc.dev
27	6

This site contains links to these domains. Also see Links.

Domain
www.introducers.santander.co.uk

Subject Issuer	Validity	Valid
*.lewiscc.dev Sectigo RSA Domain Validation Secure Server CA	`2024-03-06` - `2025-03-07`	a year	crt.sh
fonts.net GTS CA 1P5	`2024-04-04` - `2024-07-03`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-11` - `2024-07-14`	a year	crt.sh
marker.io GTS CA 1P5	`2024-04-16` - `2024-07-15`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://sfi.lewiscc.dev/
Frame ID: 3E84BAC616574C055C2C15F26196C55F
Requests: 26 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Home | Santander for Intermediaries | Development

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

27
Requests

93 %
HTTPS

50 %
IPv6

5
Domains

6
Subdomains

5
IPs

2
Countries

1350 kB
Transfer

2812 kB
Size

2
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.introducers.santander.co.uk/Security/Security/Login?ei=0&m=0
Title: Log On

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

27 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
sfi.lewiscc.dev/ 22 KB
6 KB 468ms
160ms Document
text/html 185.94.235.168
CONSIDERIT

General

Check archive.org

Show headers Download Go to

Full URL: https://sfi.lewiscc.dev/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.94.235.168 , United Kingdom, ASN47492 (CONSIDERIT, GB),
Reverse DNS: 185-94-235-168.ip-space.cit.net.uk
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 43869606fbc5b511d10902b10376f530394529a858ba322d6d7e6d6ad02547b9

Request headers

Accept-Language: en-US,en;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: gzip
content-type: text/html; charset=utf-8
date: Thu, 02 May 2024 12:08:34 GMT
server: Microsoft-IIS/10.0
vary: Accept-Encoding
x-powered-by: ASP.NET

GET
H2 200 353d6d55-bea8-431c-b75d-24d3f948b295.css
fast.fonts.net/cssapi/ 2 KB
1 KB 227ms
141ms Stylesheet
text/css 2606:4700::6810:291c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://fast.fonts.net/cssapi/353d6d55-bea8-431c-b75d-24d3f948b295.css
Requested by: Host: sfi.lewiscc.dev
URL: https://sfi.lewiscc.dev/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:291c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ba3c1e5e0fd68f8e23c73fe97033234b3fb7f390d4ed860cc0b021d25ac49ff5

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://sfi.lewiscc.dev/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 02 May 2024 12:08:34 GMT
x-amz-version-id: null
content-encoding: gzip
cf-cache-status: REVALIDATED
x-amz-meta-user-agent-id: wfsSFTPtoS3@s-204fa1710a0a4f788
x-amz-request-id: HD4NSPJXVJ3E3GVG
x-amz-id-2: ZOVjL92Vi0RcEyMs8IupSJjopl1ToThQWhUG+/7Xxtm6LGEvccLB4xqJ+XoGCwte/DlQMRCHZwI=
last-modified: Tue, 20 Jul 2021 08:17:51 GMT
server: cloudflare
etag: W/"ded5098e3506f1c38c9e89f64f3ef593"
x-amz-meta-user-agent: AWSTransfer
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=300
cf-ray: 87d7e5c0980da534-MIA
expires: Thu, 02 May 2024 12:13:34 GMT

GET
H2 200 main.3fc331cad175260075ae.css
sfi.lewiscc.dev/dist/css/ 339 KB
72 KB 143ms
142ms Stylesheet
text/css 185.94.235.168
CONSIDERIT

General

Check archive.org

Show headers Download Go to

Full URL: https://sfi.lewiscc.dev/dist/css/main.3fc331cad175260075ae.css
Requested by: Host: sfi.lewiscc.dev
URL: https://sfi.lewiscc.dev/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.94.235.168 , United Kingdom, ASN47492 (CONSIDERIT, GB),
Reverse DNS: 185-94-235-168.ip-space.cit.net.uk
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e5658b52b9d71af7f5a9aeea13cb8341e8fdb60cf5a066c573f3e02903bd0b12

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://sfi.lewiscc.dev/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 02 May 2024 12:08:34 GMT
content-encoding: gzip
last-modified: Mon, 25 Mar 2024 10:35:38 GMT
server: Microsoft-IIS/10.0
etag: "1da7ea02d44f37e"
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes

GET
H2 200 main.3fc331cad175260075ae.js Show response
sfi.lewiscc.dev/dist/js/ 723 KB
236 KB 143ms
142ms Script
text/javascript 185.94.235.168
CONSIDERIT

General

Check archive.org

Show headers Download Go to

Full URL: https://sfi.lewiscc.dev/dist/js/main.3fc331cad175260075ae.js
Requested by: Host: sfi.lewiscc.dev
URL: https://sfi.lewiscc.dev/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.94.235.168 , United Kingdom, ASN47492 (CONSIDERIT, GB),
Reverse DNS: 185-94-235-168.ip-space.cit.net.uk
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e2c1d79dd9705f4730f41915b1befa3ff43893c1a163fea1bb64c4e5d2bad994

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://sfi.lewiscc.dev/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 02 May 2024 12:08:34 GMT
content-encoding: gzip
last-modified: Mon, 25 Mar 2024 10:35:38 GMT
server: Microsoft-IIS/10.0
etag: "1da7ea02d4af413"
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: text/javascript
accept-ranges: bytes

GET
H2 200 santander-logo-red.jpg
sfi.lewiscc.dev/dist/images/ 172 KB
172 KB 142ms
142ms Image
image/jpeg 185.94.235.168
CONSIDERIT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sfi.lewiscc.dev/dist/images/santander-logo-red.jpg
Requested by: Host: sfi.lewiscc.dev
URL: https://sfi.lewiscc.dev/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.94.235.168 , United Kingdom, ASN47492 (CONSIDERIT, GB),
Reverse DNS: 185-94-235-168.ip-space.cit.net.uk
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 3a2a0f0e48a351205e8573e8e67082fc211dfb485991946ff78f871e7263f9e0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://sfi.lewiscc.dev/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 02 May 2024 12:08:34 GMT
last-modified: Mon, 25 Mar 2024 10:35:38 GMT
server: Microsoft-IIS/10.0
etag: "1da7ea02d430828"
x-powered-by: ASP.NET
content-type: image/jpeg
accept-ranges: bytes
content-length: 176424

GET
H2 200 sfi-flame.svg
sfi.lewiscc.dev/dist/images/ 649 B
715 B 142ms
141ms Image
image/svg+xml 185.94.235.168
CONSIDERIT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sfi.lewiscc.dev/dist/images/sfi-flame.svg
Requested by: Host: sfi.lewiscc.dev
URL: https://sfi.lewiscc.dev/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.94.235.168 , United Kingdom, ASN47492 (CONSIDERIT, GB),
Reverse DNS: 185-94-235-168.ip-space.cit.net.uk
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 7ea51ee2785949babe6387b65e684c39b4bb4c5703d85e7da532dc792bccf879

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://sfi.lewiscc.dev/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 02 May 2024 12:08:34 GMT
last-modified: Mon, 25 Mar 2024 10:35:38 GMT
server: Microsoft-IIS/10.0
etag: "1da7ea02d41bb89"
x-powered-by: ASP.NET
content-type: image/svg+xml
accept-ranges: bytes
content-length: 649

GET
H2 200 dummy-image.png
sfi.lewiscc.dev/media/wjbpfhyf/ 12 KB
12 KB 281ms
281ms Image
image/png 185.94.235.168
CONSIDERIT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sfi.lewiscc.dev/media/wjbpfhyf/dummy-image.png?width=1900&height=450&v=1d9617e12b70c60
Requested by: Host: sfi.lewiscc.dev
URL: https://sfi.lewiscc.dev/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.94.235.168 , United Kingdom, ASN47492 (CONSIDERIT, GB),
Reverse DNS: 185-94-235-168.ip-space.cit.net.uk
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: c7ebe8216c2a999fa8397a0978bad7f19061c060f35e0dd2c844d50c8cd6a6c0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://sfi.lewiscc.dev/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 02 May 2024 12:08:34 GMT
last-modified: Sun, 31 Mar 2024 08:32:36 GMT
server: Microsoft-IIS/10.0
etag: "1da8345fbb85ac1"
x-powered-by: ASP.NET
content-type: image/png
cache-control: public, max-age=604800, immutable
accept-ranges: bytes
content-length: 12481

GET
H2 200 cta-icon.png
sfi.lewiscc.dev/media/na0njtnu/ 935 B
1013 B 280ms
279ms Image
image/png 185.94.235.168
CONSIDERIT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sfi.lewiscc.dev/media/na0njtnu/cta-icon.png
Requested by: Host: sfi.lewiscc.dev
URL: https://sfi.lewiscc.dev/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.94.235.168 , United Kingdom, ASN47492 (CONSIDERIT, GB),
Reverse DNS: 185-94-235-168.ip-space.cit.net.uk
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 54f8b89ae2ea2b2761f8ca1def548abe2416575ebc5883a0c9db90844f9bc270

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://sfi.lewiscc.dev/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 02 May 2024 12:08:34 GMT
last-modified: Tue, 04 Apr 2023 10:00:18 GMT
server: Microsoft-IIS/10.0
etag: "1d966dc429466a7"
x-powered-by: ASP.NET
content-type: image/png
accept-ranges: bytes
content-length: 935

GET
H2 200 vector.png
sfi.lewiscc.dev/media/zg1dbsey/ 1 KB
1 KB 141ms
141ms Image
image/png 185.94.235.168
CONSIDERIT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sfi.lewiscc.dev/media/zg1dbsey/vector.png
Requested by: Host: sfi.lewiscc.dev
URL: https://sfi.lewiscc.dev/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.94.235.168 , United Kingdom, ASN47492 (CONSIDERIT, GB),
Reverse DNS: 185-94-235-168.ip-space.cit.net.uk
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 784ad89d64b9e1c23fb9496ab0babbe23b6dc693dcdf6ae6d145961919a54720

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://sfi.lewiscc.dev/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 02 May 2024 12:08:34 GMT
last-modified: Wed, 24 May 2023 11:46:23 GMT
server: Microsoft-IIS/10.0
etag: "1d98e355d11d51d"
x-powered-by: ASP.NET
content-type: image/png
accept-ranges: bytes
content-length: 1181

GET
H2 200 vector2.png
sfi.lewiscc.dev/media/3exkq1m3/ 639 B
694 B 142ms
141ms Image
image/png 185.94.235.168
CONSIDERIT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sfi.lewiscc.dev/media/3exkq1m3/vector2.png
Requested by: Host: sfi.lewiscc.dev
URL: https://sfi.lewiscc.dev/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.94.235.168 , United Kingdom, ASN47492 (CONSIDERIT, GB),
Reverse DNS: 185-94-235-168.ip-space.cit.net.uk
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 390197e87038764e4cfeb3179aceaffaa58bf94150bf46be328fcdb7de9a96b6

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://sfi.lewiscc.dev/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 02 May 2024 12:08:34 GMT
last-modified: Wed, 24 May 2023 11:46:23 GMT
server: Microsoft-IIS/10.0
etag: "1d98e355d11d3ff"
x-powered-by: ASP.NET
content-type: image/png
accept-ranges: bytes
content-length: 639

GET
H2 200 dummy-image.png
sfi.lewiscc.dev/media/wjbpfhyf/ 8 KB
8 KB 143ms
142ms Image
image/png 185.94.235.168
CONSIDERIT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sfi.lewiscc.dev/media/wjbpfhyf/dummy-image.png?width=1200&height=450&v=1d9617e12b70c60
Requested by: Host: sfi.lewiscc.dev
URL: https://sfi.lewiscc.dev/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.94.235.168 , United Kingdom, ASN47492 (CONSIDERIT, GB),
Reverse DNS: 185-94-235-168.ip-space.cit.net.uk
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 0edc0bd37d5f4b8e882497636027c6a20f689dbf487855645d20e841bb32492a

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://sfi.lewiscc.dev/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 02 May 2024 12:08:34 GMT
last-modified: Fri, 29 Mar 2024 19:45:47 GMT
server: Microsoft-IIS/10.0
etag: "1da8211b1ce79d5"
x-powered-by: ASP.NET
content-type: image/png
cache-control: public, max-age=604800, immutable
accept-ranges: bytes
content-length: 7765

GET
H2 200 jquery-3.7.1.js Show response
code.jquery.com/ 279 KB
82 KB 106ms
31ms Script
application/javascript 2a04:4e42:400::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.7.1.js
Requested by: Host: sfi.lewiscc.dev
URL: https://sfi.lewiscc.dev/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:400::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 78a85aca2f0b110c29e0d2b137e09f0a1fb7a8e554b499f740d6744dc8962cfe

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://sfi.lewiscc.dev/
Origin: https://sfi.lewiscc.dev
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 02 May 2024 12:08:35 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 12029559
x-cache: HIT, HIT
content-length: 83619
x-served-by: cache-lga21929-LGA, cache-mia-kmia1760088-MIA
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-timer: S1714651715.226997,VS0,VE0
etag: W/"28feccc0-45a82"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=604800
accept-ranges: bytes
x-cache-hits: 12866, 553

GET authenticated-webchat
webchat-staging.santanderforintermediaries.co.uk/bundles/ 0
0

GET authenticated-webchat-style
webchat-staging.santanderforintermediaries.co.uk/bundles/ 0
0

GET
H2 200 1.css
fast.fonts.net/t/ 0
253 B 45ms
45ms Stylesheet
text/css 2606:4700::6810:291c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://fast.fonts.net/t/1.css?apiType=css&projectid=353d6d55-bea8-431c-b75d-24d3f948b295
Requested by: Host: fast.fonts.net
URL: https://fast.fonts.net/cssapi/353d6d55-bea8-431c-b75d-24d3f948b295.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:291c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://fast.fonts.net/cssapi/353d6d55-bea8-431c-b75d-24d3f948b295.css
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 02 May 2024 12:08:34 GMT
x-amz-version-id: null
cf-cache-status: HIT
x-amz-request-id: A8PPZ3V8MNW2J8J2
age: 375704
content-length: 0
x-amz-id-2: WoM8ZBeJUs312oxDWaulMdPPdWrgDY+3H1An9R+phQ1yxDRAKQoRQ8/ASNhSNhf08w0atnCnho8=
last-modified: Tue, 23 Mar 2021 12:59:23 GMT
server: cloudflare
etag: "d41d8cd98f00b204e9800998ecf8427e"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
cache-control: public, max-age=0, s-maxage=604800
accept-ranges: bytes
cf-ray: 87d7e5c17919a534-MIA
x-amz-meta-mtime: 1519217722

GET
H3 200 shim.js Show response
edge.marker.io/latest/ 58 KB
18 KB 94ms
41ms Script
text/javascript 172.67.70.243
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://edge.marker.io/latest/shim.js

Requested by

Host: sfi.lewiscc.dev
URL: https://sfi.lewiscc.dev/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.70.243 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

abfd0cba0262a992c4a62e425bf4a66a118d7e7819b1261ee360599c0e3c7252

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://sfi.lewiscc.dev/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 02 May 2024 12:08:35 GMT
via: 1.1 8bacdd433d05837a260a848dd8b0eccc.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
strict-transport-security: max-age=0; includeSubDomains; preload
x-amz-cf-pop: MIA3-P5
age: 108
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 20 Mar 2024 10:15:25 GMT
server: cloudflare
etag: W/"90a43319311100b5518e4e7b2a963b37"
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=300,public
cf-ray: 87d7e5c40942a584-MIA
x-amz-cf-id: zyhHFpuKPoCOjOAhc890fnqYHEbVBD2vPojnH-SMW1aIkNYbfaCBRw==

GET
H2 200 SantanderTextW05-Regular.woff2
sfi.lewiscc.dev/dist/fonts/ 46 KB
46 KB 285ms
283ms Font
font/woff2 185.94.235.168
CONSIDERIT

General

Check archive.org

Show headers Download Go to

Full URL: https://sfi.lewiscc.dev/dist/fonts/SantanderTextW05-Regular.woff2
Requested by: Host: sfi.lewiscc.dev
URL: https://sfi.lewiscc.dev/dist/css/main.3fc331cad175260075ae.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.94.235.168 , United Kingdom, ASN47492 (CONSIDERIT, GB),
Reverse DNS: 185-94-235-168.ip-space.cit.net.uk
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: df7abc314cf6e0380973cea5ad3cd7a4536b820d974162c9d94f534f539eef0b

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://sfi.lewiscc.dev/dist/css/main.3fc331cad175260075ae.css
Origin: https://sfi.lewiscc.dev
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 02 May 2024 12:08:34 GMT
last-modified: Mon, 25 Mar 2024 10:35:38 GMT
server: Microsoft-IIS/10.0
etag: "1da7ea02d410f30"
x-powered-by: ASP.NET
content-type: font/woff2
accept-ranges: bytes
content-length: 46640

GET
H2 200 SantanderTextW05-Bold.woff2
sfi.lewiscc.dev/dist/fonts/ 48 KB
48 KB 284ms
282ms Font
font/woff2 185.94.235.168
CONSIDERIT

General

Check archive.org

Show headers Download Go to

Full URL: https://sfi.lewiscc.dev/dist/fonts/SantanderTextW05-Bold.woff2
Requested by: Host: sfi.lewiscc.dev
URL: https://sfi.lewiscc.dev/dist/css/main.3fc331cad175260075ae.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.94.235.168 , United Kingdom, ASN47492 (CONSIDERIT, GB),
Reverse DNS: 185-94-235-168.ip-space.cit.net.uk
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: ec6c6c35a35bb74b562f10541e42adcb73c8bf54fbbd2a2999078bde1a279e29

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://sfi.lewiscc.dev/dist/css/main.3fc331cad175260075ae.css
Origin: https://sfi.lewiscc.dev
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 02 May 2024 12:08:34 GMT
last-modified: Mon, 25 Mar 2024 10:35:38 GMT
server: Microsoft-IIS/10.0
etag: "1da7ea02d4106b0"
x-powered-by: ASP.NET
content-type: font/woff2
accept-ranges: bytes
content-length: 49072

GET
H2 200 SFI-Icons.ttf
sfi.lewiscc.dev/dist/fonts/ 356 KB
356 KB 423ms
421ms Font
application/x-font-ttf 185.94.235.168
CONSIDERIT

General

Check archive.org

Show headers Download Go to

Full URL: https://sfi.lewiscc.dev/dist/fonts/SFI-Icons.ttf
Requested by: Host: sfi.lewiscc.dev
URL: https://sfi.lewiscc.dev/dist/css/main.3fc331cad175260075ae.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.94.235.168 , United Kingdom, ASN47492 (CONSIDERIT, GB),
Reverse DNS: 185-94-235-168.ip-space.cit.net.uk
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 0e6dedde00af527bea9ade877679a5b30a1a34e2ea53cf4fde86a64660062f74

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://sfi.lewiscc.dev/dist/css/main.3fc331cad175260075ae.css
Origin: https://sfi.lewiscc.dev
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 02 May 2024 12:08:34 GMT
last-modified: Mon, 25 Mar 2024 10:35:38 GMT
server: Microsoft-IIS/10.0
etag: "1da7ea02d442990"
x-powered-by: ASP.NET
content-type: application/x-font-ttf
accept-ranges: bytes
content-length: 364688

GET
H2 200 SantanderHeadlineW05-Rg.woff2
sfi.lewiscc.dev/dist/fonts/ 46 KB
46 KB 287ms
285ms Font
font/woff2 185.94.235.168
CONSIDERIT

General

Check archive.org

Show headers Download Go to

Full URL: https://sfi.lewiscc.dev/dist/fonts/SantanderHeadlineW05-Rg.woff2
Requested by: Host: sfi.lewiscc.dev
URL: https://sfi.lewiscc.dev/dist/css/main.3fc331cad175260075ae.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.94.235.168 , United Kingdom, ASN47492 (CONSIDERIT, GB),
Reverse DNS: 185-94-235-168.ip-space.cit.net.uk
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 535c47209ecf005f74929ba3bd50b107a702bead1f165b856e002165a1a56ba8

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://sfi.lewiscc.dev/dist/css/main.3fc331cad175260075ae.css
Origin: https://sfi.lewiscc.dev
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 02 May 2024 12:08:34 GMT
last-modified: Mon, 25 Mar 2024 10:35:38 GMT
server: Microsoft-IIS/10.0
etag: "1da7ea02d410fc4"
x-powered-by: ASP.NET
content-type: font/woff2
accept-ranges: bytes
content-length: 46788

GET
H2 200 SantanderHeadlineW05-Bold.woff2
sfi.lewiscc.dev/dist/fonts/ 48 KB
48 KB 420ms
418ms Font
font/woff2 185.94.235.168
CONSIDERIT

General

Check archive.org

Show headers Download Go to

Full URL: https://sfi.lewiscc.dev/dist/fonts/SantanderHeadlineW05-Bold.woff2
Requested by: Host: sfi.lewiscc.dev
URL: https://sfi.lewiscc.dev/dist/css/main.3fc331cad175260075ae.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.94.235.168 , United Kingdom, ASN47492 (CONSIDERIT, GB),
Reverse DNS: 185-94-235-168.ip-space.cit.net.uk
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: d9292f5aeb67c87cd795b51fcd918e5d2b5a5adb7fa66659e82ad4b67471e6d3

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://sfi.lewiscc.dev/dist/css/main.3fc331cad175260075ae.css
Origin: https://sfi.lewiscc.dev
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 02 May 2024 12:08:34 GMT
last-modified: Mon, 25 Mar 2024 10:35:38 GMT
server: Microsoft-IIS/10.0
etag: "1da7ea02d4107f4"
x-powered-by: ASP.NET
content-type: font/woff2
accept-ranges: bytes
content-length: 48884

GET
H3 200 3.v2.9.4.594cee46e865d1ff5f9b.js Show response
edge.marker.io/latest/ 213 KB
67 KB 69ms
68ms Script
text/javascript 172.67.70.243
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://edge.marker.io/latest/3.v2.9.4.594cee46e865d1ff5f9b.js

Requested by

Host: edge.marker.io
URL: https://edge.marker.io/latest/shim.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.70.243 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6016b0db52f0161145328acfa6dc6cc356c97258f865b9834c58d31331de9d43

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://sfi.lewiscc.dev/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 02 May 2024 12:08:35 GMT
content-encoding: br
via: 1.1 aab97f44d1fd9aa4917e5ee232773a52.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-content-type-options: nosniff
strict-transport-security: max-age=0; includeSubDomains; preload
x-amz-cf-pop: MIA3-P5
age: 2304
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 20 Mar 2024 10:15:23 GMT
server: cloudflare
etag: W/"91ac4269b5df0a1edd1c973151bbf6a0"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: text/javascript
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin, Access-Control-Request-Method
vary: Accept-Encoding
cf-ray: 87d7e5c54ac5a584-MIA
x-amz-cf-id: VGcXIYTnxYiQkipjgE6aVOYZp-VXU43k3-b8NjQs0jbtH1DpW3ug5Q==

GET
H3 200 4.v2.9.4.f4d29df28f5f668cd585.js Show response
edge.marker.io/latest/ 249 KB
57 KB 38ms
37ms Script
text/javascript 172.67.70.243
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://edge.marker.io/latest/4.v2.9.4.f4d29df28f5f668cd585.js

Requested by

Host: edge.marker.io
URL: https://edge.marker.io/latest/shim.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.70.243 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f016c29a9f3aaac17f537c06f211ca7cacb1e0bdd3425d5cb61f71a6550d3f96

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://sfi.lewiscc.dev/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 02 May 2024 12:08:35 GMT
content-encoding: br
via: 1.1 550095e901774e11f1c0214c5ce186ae.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-content-type-options: nosniff
strict-transport-security: max-age=0; includeSubDomains; preload
x-amz-cf-pop: MIA3-P5
age: 3656
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 20 Mar 2024 10:15:23 GMT
server: cloudflare
etag: W/"16f3ddf5a67900bc5efde442109ca499"
vary: Accept-Encoding
content-type: text/javascript
cf-ray: 87d7e5c54ac7a584-MIA
x-amz-cf-id: PSJC2uOaPv0e3ctVhtEUjmhtHbiHNMkLAFQQX7EsCceAY6P1pyJcag==

OPTIONS
H3 204 ping
api.marker.io/widget/ 0
0 187ms
138ms Preflight 172.67.70.243
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.marker.io/widget/ping

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.70.243 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://sfi.lewiscc.dev
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-CSRF-Token, X-Requested-With, Accept, Accept-Version, Authorization, Content-Length, Content-MD5, Content-Type, Date, X-Api-Version, _c, Request-Context, x-xsrf-token
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
access-control-allow-origin: https://sfi.lewiscc.dev
access-control-max-age: 86400
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 87d7e5c73f016dcb-MIA
content-security-policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: cross-origin
date: Thu, 02 May 2024 12:08:35 GMT
origin-agent-cluster: ?1
referrer-policy: no-referrer
server: cloudflare
strict-transport-security: max-age=0; includeSubDomains; preload
vary: Origin
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0

POST
H3 200 ping Show response
api.marker.io/widget/ 3 KB
2 KB 193ms
151ms Fetch
application/json 172.67.70.243
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.marker.io/widget/ping

Requested by

Host: edge.marker.io
URL: https://edge.marker.io/latest/4.v2.9.4.f4d29df28f5f668cd585.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.70.243 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d10157acf3f44676ef2f725d938ee93004f0d83120f36271ac1a173f5e987ac0

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://sfi.lewiscc.dev/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 02 May 2024 12:08:36 GMT
content-security-policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
x-content-type-options: nosniff
strict-transport-security: max-age=0; includeSubDomains; preload
cf-cache-status: DYNAMIC
x-permitted-cross-domain-policies: none
content-encoding: br
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
referrer-policy: no-referrer
server: cloudflare
cross-origin-opener-policy: same-origin
etag: W/"c35-aGzrfUkpCtHy2eR2Oneo7NQsLbI"
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Origin, X-HTTP-Method-Override, Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://sfi.lewiscc.dev
origin-agent-cluster: ?1
access-control-allow-credentials: true
cf-ray: 87d7e5c85b8ea575-MIA

GET
H3 200 5.v2.9.4.69a3bfbe39c292ad6494.js Show response
edge.marker.io/latest/ 163 KB
47 KB 38ms
38ms Script
text/javascript 172.67.70.243
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://edge.marker.io/latest/5.v2.9.4.69a3bfbe39c292ad6494.js

Requested by

Host: edge.marker.io
URL: https://edge.marker.io/latest/shim.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.70.243 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e7c9e2b565ebb3644321f60a6b2c51e2815bc43ea350d54a10252462206f4f68

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://sfi.lewiscc.dev/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 02 May 2024 12:08:36 GMT
content-encoding: br
via: 1.1 1147f36b9ca4976d48a312f61f6875be.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-content-type-options: nosniff
strict-transport-security: max-age=0; includeSubDomains; preload
x-amz-cf-pop: MIA3-P5
age: 1496
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 20 Mar 2024 10:15:23 GMT
server: cloudflare
etag: W/"06a9c2104c9e58d3a842a7b3d9c8be34"
vary: Accept-Encoding
content-type: text/javascript
cf-ray: 87d7e5c95f60a584-MIA
x-amz-cf-id: cElFwW10V1d57kWFqM9f6Ozco31M_2W-eEMeJEQqMAD3xwLUh32JhA==

GET
H2 200 favicon.ico
sfi.lewiscc.dev/ 22 KB
22 KB 142ms
141ms Other
image/x-icon 185.94.235.168
CONSIDERIT

General

Check archive.org

Show headers Download Go to

Full URL: https://sfi.lewiscc.dev/favicon.ico
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.94.235.168 , United Kingdom, ASN47492 (CONSIDERIT, GB),
Reverse DNS: 185-94-235-168.ip-space.cit.net.uk
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 4c1db2844b8d24c83fc7bc0263dc5e5ab708f6f136b8314f97052d17bcfc5b40

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://sfi.lewiscc.dev/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 02 May 2024 12:08:36 GMT
last-modified: Mon, 25 Mar 2024 10:33:52 GMT
server: Microsoft-IIS/10.0
etag: "1da7e9fee133fd6"
x-powered-by: ASP.NET
content-type: image/x-icon
accept-ranges: bytes
content-length: 22486

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: webchat-staging.santanderforintermediaries.co.uk
URL: https://webchat-staging.santanderforintermediaries.co.uk/bundles/authenticated-webchat

Domain: webchat-staging.santanderforintermediaries.co.uk
URL: https://webchat-staging.santanderforintermediaries.co.uk/bundles/authenticated-webchat-style

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Santander (Banking)

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.fonts.net/	1970-01-20 20:17:33	Name: __cf_bm Value: hnjAT4aT5vT._OOB_wPQUYfT_SbwxDlbJjycFG4j0d8-1714651714-1.0.1.1-MkBmkGIRQWxoUw85uvESpmLfU7Zb.rgw5kvkBXurrkV0z7CR5vF35visH5ibl5WoOaLieShBJoE0PdoqEJCpdA
			sfi.lewiscc.dev/	1970-01-21 02:46:19	Name: marker_id_6491a14fa44c73acaf6a2ab1 Value: 31b35830-e0ec-4e15-8f46-110b5ff66dac

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://sfi.lewiscc.dev/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://sfi.lewiscc.dev/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.marker.io
code.jquery.com
edge.marker.io
fast.fonts.net
sfi.lewiscc.dev
webchat-staging.santanderforintermediaries.co.uk
webchat-staging.santanderforintermediaries.co.uk
172.67.70.243
185.94.235.168
2606:4700::6810:291c
2a04:4e42:400::649
0e6dedde00af527bea9ade877679a5b30a1a34e2ea53cf4fde86a64660062f74
0edc0bd37d5f4b8e882497636027c6a20f689dbf487855645d20e841bb32492a
390197e87038764e4cfeb3179aceaffaa58bf94150bf46be328fcdb7de9a96b6
3a2a0f0e48a351205e8573e8e67082fc211dfb485991946ff78f871e7263f9e0
43869606fbc5b511d10902b10376f530394529a858ba322d6d7e6d6ad02547b9
4c1db2844b8d24c83fc7bc0263dc5e5ab708f6f136b8314f97052d17bcfc5b40
535c47209ecf005f74929ba3bd50b107a702bead1f165b856e002165a1a56ba8
54f8b89ae2ea2b2761f8ca1def548abe2416575ebc5883a0c9db90844f9bc270
6016b0db52f0161145328acfa6dc6cc356c97258f865b9834c58d31331de9d43
784ad89d64b9e1c23fb9496ab0babbe23b6dc693dcdf6ae6d145961919a54720
78a85aca2f0b110c29e0d2b137e09f0a1fb7a8e554b499f740d6744dc8962cfe
7ea51ee2785949babe6387b65e684c39b4bb4c5703d85e7da532dc792bccf879
abfd0cba0262a992c4a62e425bf4a66a118d7e7819b1261ee360599c0e3c7252
ba3c1e5e0fd68f8e23c73fe97033234b3fb7f390d4ed860cc0b021d25ac49ff5
c7ebe8216c2a999fa8397a0978bad7f19061c060f35e0dd2c844d50c8cd6a6c0
d10157acf3f44676ef2f725d938ee93004f0d83120f36271ac1a173f5e987ac0
d9292f5aeb67c87cd795b51fcd918e5d2b5a5adb7fa66659e82ad4b67471e6d3
df7abc314cf6e0380973cea5ad3cd7a4536b820d974162c9d94f534f539eef0b
e2c1d79dd9705f4730f41915b1befa3ff43893c1a163fea1bb64c4e5d2bad994
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5658b52b9d71af7f5a9aeea13cb8341e8fdb60cf5a066c573f3e02903bd0b12
e7c9e2b565ebb3644321f60a6b2c51e2815bc43ea350d54a10252462206f4f68
ec6c6c35a35bb74b562f10541e42adcb73c8bf54fbbd2a2999078bde1a279e29
f016c29a9f3aaac17f537c06f211ca7cacb1e0bdd3425d5cb61f71a6550d3f96

sfi.lewiscc.dev Open in urlscan Pro 185.94.235.168 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

27 Requests

93 %HTTPS

50 %IPv6

5 Domains

6 Subdomains

5 IPs

2 Countries

1350 kBTransfer

2812 kBSize

2 Cookies

1 Outgoing links

Redirected requests

27 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

16 JavaScript Global Variables

2 Cookies

2 Console Messages

Indicators

sfi.lewiscc.dev Open in urlscan Pro
185.94.235.168 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

27
Requests

93 %
HTTPS

50 %
IPv6

5
Domains

6
Subdomains

5
IPs

2
Countries

1350 kB
Transfer

2812 kB
Size

2
Cookies

27 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!