ugyintezesrol-kft.dominantlegaltrans.com Open in urlscan Pro
162.144.3.115 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://weber.espalhaobem.com.br/wp-admin/nab.php
Effective URL:
https://ugyintezesrol-kft.dominantlegaltrans.com/nab/index.php
Submission: On July 08 via automatic, source openphish (July 8th 2024, 3:01:06 pm UTC) — Scanned from DE

Summary HTTP 3 Redirects Links 5 Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 3 HTTP transactions. The main IP is 162.144.3.115, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is ugyintezesrol-kft.dominantlegaltrans.com.
TLS certificate: Issued by R3 on May 8th 2024. Valid for: 3 months.

This is the only time ugyintezesrol-kft.dominantlegaltrans.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: NAB Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	108.167.168.55 108.167.168.55	19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING)
1	162.144.3.115 162.144.3.115	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
1	2.23.209.148 2.23.209.148	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	15.197.193.217 15.197.193.217	16509 (AMAZON-02) (AMAZON-02)
3	4

1 108.167.168.55 (United States) 1 redirects

ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: 108-167-168-55.unifiedlayer.com

weber.espalhaobem.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.144.3.115 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 162-144-3-115.unifiedlayer.com

ugyintezesrol-kft.dominantlegaltrans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.23.209.148 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-23-209-148.deploy.static.akamaitechnologies.com

www.nab.com.au	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 15.197.193.217 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	adsrvr.org match.adsrvr.org — Cisco Umbrella Rank: 493	149 B
1	nab.com.au www.nab.com.au — Cisco Umbrella Rank: 496710	13 KB
1	dominantlegaltrans.com ugyintezesrol-kft.dominantlegaltrans.com	1 MB
1	espalhaobem.com.br 1 redirects weber.espalhaobem.com.br	119 B
3	4

	Domain	Requested by
1	match.adsrvr.org	srcdoc
1	www.nab.com.au	srcdoc
1	ugyintezesrol-kft.dominantlegaltrans.com
1	weber.espalhaobem.com.br	1 redirects
3	4

This site contains links to these domains. Also see Links.

Domain
www.nab.com.au
ib.nab.com.au

Subject Issuer	Validity	Valid
www.ugyintezesrol-kft.dominantlegaltrans.com R3	`2024-05-08` - `2024-08-06`	3 months	crt.sh
www.nab.com.au Entrust Certification Authority - L1M	`2024-04-24` - `2024-10-28`	6 months	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2024-04-23` - `2025-05-25`	a year	crt.sh

This page contains 3 frames:

Primary Page: https://ugyintezesrol-kft.dominantlegaltrans.com/nab/index.php
Frame ID: ACCC852E067E9176B34171E58A73B179
Requests: 8 HTTP requests in this frame

Frame: https://www.nab.com.au/personal/online-banking/nab-internet-banking/ib-login-banner/_jcr_content/root/responsivegrid/section_container_co/responsivegrid/feature_container_co/responsivegrid/feature_content_secondary/image.coreimg.95.512.jpeg/1669738874750/red-star-decorative-iblogout-500x500.jpeg
Frame ID: E7E382D4B5EDA5BECE85C3FB3B20F3BB
Requests: 4 HTTP requests in this frame

Frame: https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=ea581b1f-99ce-43b9-974b-4d0cba4b806a&google_gid=CAESEJREOPm-mPQcebxAFJ60FO0&google_cver=1
Frame ID: 73FAE6E72E5B58BAEBBF3730DA3E8233
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

NAB Internet Banking

Page URL History Show full URLs

https://weber.espalhaobem.com.br/wp-admin/nab.php HTTP 302
https://ugyintezesrol-kft.dominantlegaltrans.com/nab/index.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

3
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

1448 kB
Transfer

3875 kB
Size

1
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: https://www.nab.com.au/personal/online-banking/nab-internet-banking/sms-security
Title: Help

Search URL Search Domain Scan URL

URL: https://www.nab.com.au/about-us/security
Title: Security

Search URL Search Domain Scan URL

URL: https://www.nab.com.au/contact-us
Title: Contact us

Search URL Search Domain Scan URL

URL: https://www.nab.com.au/locations
Title: Locate us

Search URL Search Domain Scan URL

URL: https://ib.nab.com.au/#standardLink
Title: Register now

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://weber.espalhaobem.com.br/wp-admin/nab.php HTTP 302
https://ugyintezesrol-kft.dominantlegaltrans.com/nab/index.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions
10 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request index.php Show response
ugyintezesrol-kft.dominantlegaltrans.com/nab/
Redirect Chain

https://weber.espalhaobem.com.br/wp-admin/nab.php
https://ugyintezesrol-kft.dominantlegaltrans.com/nab/index.php

3 MB
1 MB

2709ms
1685ms

Document
text/html

162.144.3.115
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://ugyintezesrol-kft.dominantlegaltrans.com/nab/index.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.144.3.115 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 162-144-3-115.unifiedlayer.com
Software: Apache /
Resource Hash: 8c986277e6573a83f66177626e738030280d2a78399ed7e6ca34334dd23028f2

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 08 Jul 2024 15:00:56 GMT
server: Apache
vary: Accept-Encoding

Redirect headers

content-length: 0
content-type: text/html; charset=UTF-8
date: Mon, 08 Jul 2024 15:00:55 GMT
location: https://ugyintezesrol-kft.dominantlegaltrans.com/nab/index.php
server: Apache

GET
DATA 200
OK truncated
/ 9 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ce56c017a4b04dd507163f35d6c09d6c28ca91b7d468fd808cdc3a50358cad1c

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 195 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 02de1f52cd99150184f0d6220900f86a724fe4366f096d280fb12e7a1e44b389

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 12 KB
12 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f951333e6474d4b7f9cd23d5afea66130b4175f40b88f3b0979d545663d391ec

Request headers

Referer
Origin: https://ugyintezesrol-kft.dominantlegaltrans.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: font/woff2

GET
DATA 200
OK truncated
/ 22 KB
22 KB Font
font/woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 67d388dd39127840ca765af955cb892125b87d271e49de699778de98ff527689

Request headers

Referer
Origin: https://ugyintezesrol-kft.dominantlegaltrans.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: font/woff

GET
DATA 200
OK truncated
/ 17 KB
17 KB Font
font/woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 760a5ecb51ae9bee28469d621b6604d62c8c7c4685c307aa36bcd2d7d28763b6

Request headers

Referer
Origin: https://ugyintezesrol-kft.dominantlegaltrans.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: font/woff

GET
DATA 200
OK truncated
/ 25 KB
25 KB Font
font/woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c7e96542cb7c5e6455b76d3645823956ba90bfa5591f79b17528de5f95e78483

Request headers

Referer
Origin: https://ugyintezesrol-kft.dominantlegaltrans.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: font/woff

GET
DATA 200
OK truncated
/ 123 KB
123 KB Font
font/woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: adfcb007326055dfc42f35bda68fabf69cfb5f3a7c2b57ba3fd013be78d12f53

Request headers

Referer
Origin: https://ugyintezesrol-kft.dominantlegaltrans.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: font/woff

GET
H2 200 red-star-decorative-iblogout-500x500.jpeg
www.nab.com.au/personal/online-banking/nab-internet-banking/ib-login-banner/_jcr_content/root/responsivegrid/section_container_co/responsivegrid/feature_container_co/responsivegrid/feature_content_... Frame E7E3 13 KB
13 KB 236ms
69ms Image
image/avif 2.23.209.148
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.nab.com.au/personal/online-banking/nab-internet-banking/ib-login-banner/_jcr_content/root/responsivegrid/section_container_co/responsivegrid/feature_container_co/responsivegrid/feature_content_secondary/image.coreimg.95.512.jpeg/1669738874750/red-star-decorative-iblogout-500x500.jpeg

Requested by

Host: srcdoc
URL: about:srcdoc

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.23.209.148 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-23-209-148.deploy.static.akamaitechnologies.com

Software

Akamai Image Manager /

Resource Hash

a20c62dd96bc45ef7f052af4f432c69d85774ed319ce35d1c03b58491e1e1fdf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Mon, 08 Jul 2024 15:01:00 GMT
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
x-content-type-options: nosniff
last-modified: Fri, 31 May 2024 01:46:42 GMT
server: Akamai Image Manager
x-origin: default-rule
etag: W/"10b4c-619b627b7eba9"
content-type: image/avif
cache-control: private, no-transform, max-age=1479261
content-length: 13240
expires: Thu, 25 Jul 2024 17:55:21 GMT

GET
DATA 200
OK truncated
/ Frame E7E3 45 KB
45 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 401a7f399a463c1b791019b134e745bba7e31cd90b5991ce77d828958b4fbb59

Request headers

Referer
Origin: null
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: application/font-woff

GET
DATA 200
OK truncated
/ Frame E7E3 45 KB
45 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 202cf098b4c0d3d287c6ffad412269d960ba6a7872ecc7bd272d820b1522c708

Request headers

Referer
Origin: null
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: application/font-woff

GET
DATA 200
OK truncated
/ Frame E7E3 45 KB
45 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dc170c8efff8d40eb87be519ea9b38ad16e59ab28bf8d654259232e4c439ec6b

Request headers

Referer
Origin: null
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: application/font-woff

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame 73FA 70 B
149 B 183ms
56ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=ea581b1f-99ce-43b9-974b-4d0cba4b806a&google_gid=CAESEJREOPm-mPQcebxAFJ60FO0&google_cver=1
Requested by: Host: srcdoc
URL: about:srcdoc
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Mon, 08 Jul 2024 15:01:00 GMT
server: Kestrel
content-length: 70
content-type: image/gif

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: NAB Bank (Banking)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.nab.com.au/	1969-12-31 23:59:59	Name: akacd_www_nab_com_au Value: 3897903659~rv=30~id=e905593a4de98c1c92540ec819ff3e28

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

match.adsrvr.org
ugyintezesrol-kft.dominantlegaltrans.com
weber.espalhaobem.com.br
www.nab.com.au
108.167.168.55
15.197.193.217
162.144.3.115
2.23.209.148
02de1f52cd99150184f0d6220900f86a724fe4366f096d280fb12e7a1e44b389
202cf098b4c0d3d287c6ffad412269d960ba6a7872ecc7bd272d820b1522c708
401a7f399a463c1b791019b134e745bba7e31cd90b5991ce77d828958b4fbb59
67d388dd39127840ca765af955cb892125b87d271e49de699778de98ff527689
760a5ecb51ae9bee28469d621b6604d62c8c7c4685c307aa36bcd2d7d28763b6
8c986277e6573a83f66177626e738030280d2a78399ed7e6ca34334dd23028f2
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
a20c62dd96bc45ef7f052af4f432c69d85774ed319ce35d1c03b58491e1e1fdf
adfcb007326055dfc42f35bda68fabf69cfb5f3a7c2b57ba3fd013be78d12f53
c7e96542cb7c5e6455b76d3645823956ba90bfa5591f79b17528de5f95e78483
ce56c017a4b04dd507163f35d6c09d6c28ca91b7d468fd808cdc3a50358cad1c
dc170c8efff8d40eb87be519ea9b38ad16e59ab28bf8d654259232e4c439ec6b
f951333e6474d4b7f9cd23d5afea66130b4175f40b88f3b0979d545663d391ec

ugyintezesrol-kft.dominantlegaltrans.com Open in urlscan Pro 162.144.3.115 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

3 Requests

100 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

4 IPs

2 Countries

1448 kBTransfer

3875 kBSize

1 Cookies

5 Outgoing links

Page URL History

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 10 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

1 Cookies

Indicators

ugyintezesrol-kft.dominantlegaltrans.com Open in urlscan Pro
162.144.3.115 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

1448 kB
Transfer

3875 kB
Size

1
Cookies

3 HTTP transactions
10 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!