dmca-blog.azurewebsites.net Open in urlscan Pro
13.66.226.80 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/details.php
Effective URL:
https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/details.php
Submission: On May 22 via api (May 22nd 2024, 8:50:50 pm UTC) from US — Scanned from DE

Summary HTTP 19 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 19 HTTP transactions. The main IP is 13.66.226.80, located in United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is dmca-blog.azurewebsites.net.
TLS certificate: Issued by Microsoft Azure RSA TLS Issuing CA 08 on March 13th 2024. Valid for: a year.

This is the only time dmca-blog.azurewebsites.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: NatWest (Banking)

Domain & IP information

	IP Address		AS Autonomous System
19	13.66.226.80 13.66.226.80		8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
19	1

19 13.66.226.80 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

dmca-blog.azurewebsites.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
19	azurewebsites.net dmca-blog.azurewebsites.net	78 KB
19	1

	Domain	Requested by
19	dmca-blog.azurewebsites.net	dmca-blog.azurewebsites.net
19	1

This site contains no links.

Subject Issuer	Validity	Valid
*.azurewebsites.net Microsoft Azure RSA TLS Issuing CA 08	`2024-03-13` - `2025-03-08`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/details.php
Frame ID: DC92EAD30D25EA41C3BCE1ADE1276CEF
Requests: 3 HTTP requests in this frame

Frame: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/details.php
Frame ID: DC4736C09BD9626BAA560BFCD4FAF9F3
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Confirm Your Details

Page URL History Show full URLs

http://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/details.php HTTP 307
https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/details.php Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

19
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

78 kB
Transfer

242 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/details.php HTTP 307
https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/details.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request details.php Show response dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/ Redirect Chain http://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/details.php https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/details.php	955 B 1 KB	755ms 194ms	Document text/html	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/details.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / PHP/7.4.30 ASP.NET Resource Hash `4a30e0e808472532909d1fccf26f6034144a153b65e7df8329bfe50aa8f78458` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Response headers Cache-Control no-store, no-cache, must-revalidate Content-Encoding gzip Content-Length 684 Content-Type text/html; charset=utf-8 Date Wed, 22 May 2024 20:50:46 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Pragma no-cache Server Microsoft-IIS/10.0 Vary Accept-Encoding X-Powered-By PHP/7.4.30 ASP.NET Redirect headers Location https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/details.php Non-Authoritative-Reason HttpsUpgrades
GET H/1.1	200 OK	details.php Show response dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/ Frame DC47	32 KB 7 KB	189ms 189ms	Document text/html	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/details.php Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/details.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / PHP/7.4.30 ASP.NET Resource Hash `1ff54dfa1e63e3d54e14f28c890422042dff8311823588117f8b60b37b0ed705` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/details.php Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers Content-Encoding gzip Content-Length 6586 Content-Type text/html; charset=utf-8 Date Wed, 22 May 2024 20:50:46 GMT Server Microsoft-IIS/10.0 Vary Accept-Encoding X-Powered-By PHP/7.4.30 ASP.NET
GET H/1.1	200 OK	jspostcode.js Show response dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/ Frame DC47	12 KB 6 KB	198ms 197ms	Script application/x-javascript	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/jspostcode.js Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/details.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `5b5b18035f2e7a1a23feae2bc3235657b1168012a5010a08826755f01773c231` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/details.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Wed, 22 May 2024 20:50:46 GMT Content-Encoding gzip Last-Modified Wed, 28 Feb 2024 02:55:24 GMT Server Microsoft-IIS/10.0 ETag "c4ddd693f169da1:0" X-Powered-By ASP.NET Vary Accept-Encoding Content-Type application/x-javascript Accept-Ranges bytes Content-Length 5752
GET H/1.1	200 OK	master.css dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/ Frame DC47	133 KB 39 KB	392ms 177ms	Stylesheet text/css	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/master.css Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/details.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `75b00a583c89310d12ace059629526ba7cfbb0bd4509ec5750a25fd6ffdd6e12` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/details.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Wed, 22 May 2024 20:50:46 GMT Content-Encoding gzip Last-Modified Tue, 02 Jan 2024 09:46:58 GMT Server Microsoft-IIS/10.0 ETag "25528a1603dda1:0" X-Powered-By ASP.NET Vary Accept-Encoding Content-Type text/css Accept-Ranges bytes Content-Length 39580
GET H/1.1	200 OK	datePicker.css dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/ Frame DC47	2 KB 1 KB	740ms 189ms	Stylesheet text/css	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/datePicker.css Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/details.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `14714f651128eff786763144294b0e7c67529d317ac5371632bbf8fb659866ff` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/details.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Wed, 22 May 2024 20:50:47 GMT Content-Encoding gzip Last-Modified Tue, 02 Jan 2024 09:46:58 GMT Server Microsoft-IIS/10.0 ETag "fc3faa0603dda1:0" X-Powered-By ASP.NET Vary Accept-Encoding Content-Type text/css Accept-Ranges bytes Content-Length 948
GET H/1.1	200 OK	npc.css dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/ Frame DC47	46 KB 12 KB	926ms 374ms	Stylesheet text/css	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/npc.css Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/details.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `990f073c20457aa8ecb56a57304e16c90ec7eadb63f25e64932b2f1914054d4a` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/details.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Wed, 22 May 2024 20:50:47 GMT Content-Encoding gzip Last-Modified Tue, 02 Jan 2024 09:46:58 GMT Server Microsoft-IIS/10.0 ETag "ba16da1603dda1:0" X-Powered-By ASP.NET Vary Accept-Encoding Content-Type text/css Accept-Ranges bytes Content-Length 12272
GET H/1.1	200 OK	overlayPromptMaster.css dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/ Frame DC47	2 KB 1009 B	766ms 216ms	Stylesheet text/css	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/overlayPromptMaster.css Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/details.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `643d4d52a1a24515822f6a30683f901bb5dd16c251d88caece27ab2713457272` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/details.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Wed, 22 May 2024 20:50:47 GMT Content-Encoding gzip Last-Modified Tue, 02 Jan 2024 09:46:58 GMT Server Microsoft-IIS/10.0 ETag "ba16da1603dda1:0" X-Powered-By ASP.NET Vary Accept-Encoding Content-Type text/css Accept-Ranges bytes Content-Length 716
GET H/1.1	200 OK	overlayPrompt.css dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/ Frame DC47	76 B 474 B	764ms 197ms	Stylesheet text/css	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/overlayPrompt.css Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/details.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `ef7db794b4a6b5c42d2535919d91fb11da1e5cd1147f35196db382197b35fdee` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/details.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Wed, 22 May 2024 20:50:47 GMT Content-Encoding gzip Last-Modified Tue, 02 Jan 2024 09:46:58 GMT Server Microsoft-IIS/10.0 ETag "fc2a1a1603dda1:0" X-Powered-By ASP.NET Vary Accept-Encoding Content-Type text/css Accept-Ranges bytes Content-Length 181
GET H/1.1	200 OK	logo.png dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/ Frame DC47	3 KB 3 KB	557ms 198ms	Image image/png	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/logo.png Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/details.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `917942589e5b140755ee83bb4720ca9c1bbf7705f44f51a78ba1ffa635420c50` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/details.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Wed, 22 May 2024 20:50:47 GMT Last-Modified Tue, 02 Jan 2024 09:46:58 GMT Server Microsoft-IIS/10.0 ETag "fc2a1a1603dda1:0" X-Powered-By ASP.NET Content-Type image/png Accept-Ranges bytes Content-Length 3053
GET H/1.1	200 OK	alert-icon.png dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/ Frame DC47	638 B 885 B	204ms 199ms	Image image/png	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/alert-icon.png Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/details.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `d4901081a59d75050d215c08d6fd5370cea9aa1eaea023a176c9b9c26760f221` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/details.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Wed, 22 May 2024 20:50:47 GMT Last-Modified Tue, 02 Jan 2024 09:46:58 GMT Server Microsoft-IIS/10.0 ETag "518d3a1603dda1:0" X-Powered-By ASP.NET Content-Type image/png Accept-Ranges bytes Content-Length 638
GET H/1.1	200 OK	NPC_auralstyle.css dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/ Frame DC47	515 B 700 B	187ms 186ms	Stylesheet text/css	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/NPC_auralstyle.css Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/details.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `04c45c81e1298e703f3bde9cec27446450294330ae06bd24c9f9343b264462e9` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/details.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Wed, 22 May 2024 20:50:47 GMT Content-Encoding gzip Last-Modified Tue, 02 Jan 2024 09:46:58 GMT Server Microsoft-IIS/10.0 ETag "67b4aa1603dda1:0" X-Powered-By ASP.NET Vary Accept-Encoding Content-Type text/css Accept-Ranges bytes Content-Length 407
GET H/1.1	200 OK	master_print.css dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/ Frame DC47	5 KB 2 KB	187ms 187ms	Stylesheet text/css	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/master_print.css Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/details.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `1acd7d03edc5d90866fd012355c352efbb02f38c9334cffd4a9f321b4d713491` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/details.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Wed, 22 May 2024 20:50:47 GMT Content-Encoding gzip Last-Modified Tue, 02 Jan 2024 09:46:58 GMT Server Microsoft-IIS/10.0 ETag "beef5a1603dda1:0" X-Powered-By ASP.NET Vary Accept-Encoding Content-Type text/css Accept-Ranges bytes Content-Length 2152
GET H/1.1	200 OK	exit-icon-white.svg dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/ Frame DC47	641 B 892 B	183ms 182ms	Image image/svg+xml	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/exit-icon-white.svg Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/master.css Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `43a780414ddf2b15e9b47811bbaa8cbfc6cf56d4db65684ed114a1c2a13bc097` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/master.css Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Wed, 22 May 2024 20:50:47 GMT Last-Modified Tue, 02 Jan 2024 09:46:58 GMT Server Microsoft-IIS/10.0 ETag "518d3a1603dda1:0" X-Powered-By ASP.NET Content-Type image/svg+xml Accept-Ranges bytes Content-Length 641
GET H/1.1	404 Not Found	RNHouseSansW03-Regular.woff dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/ Frame DC47	0 0	194ms 194ms	Font text/html	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/RNHouseSansW03-Regular.woff Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/npc.css Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/npc.css Origin https://dmca-blog.azurewebsites.net Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Wed, 22 May 2024 20:50:47 GMT Server Microsoft-IIS/10.0 X-Powered-By ASP.NET Content-Length 103 Content-Type text/html
GET H/1.1	404 Not Found	RNHouseSansW03-Bold.woff dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/ Frame DC47	0 0	186ms 185ms	Font text/html	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/RNHouseSansW03-Bold.woff Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/npc.css Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/npc.css Origin https://dmca-blog.azurewebsites.net Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Wed, 22 May 2024 20:50:47 GMT Server Microsoft-IIS/10.0 X-Powered-By ASP.NET Content-Length 103 Content-Type text/html
GET H/1.1	200 OK	favicon.ico dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/	2 KB 2 KB	186ms 186ms	Other image/x-icon	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/favicon.ico Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `9bbf91204e8022d01c859c92c1d9218ac4859de521548856534b48ac2e7849a8` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/details.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Wed, 22 May 2024 20:50:47 GMT Last-Modified Tue, 02 Jan 2024 09:46:58 GMT Server Microsoft-IIS/10.0 ETag "7166fca0603dda1:0" X-Powered-By ASP.NET Content-Type image/x-icon Accept-Ranges bytes Content-Length 2238
GET H/1.1	404 Not Found	RNHouseSansW03-Bold.ttf dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/fonts/ Frame DC47	0 0	178ms 177ms	Font text/html	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/fonts/RNHouseSansW03-Bold.ttf Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/npc.css Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/npc.css Origin https://dmca-blog.azurewebsites.net Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Wed, 22 May 2024 20:50:47 GMT Server Microsoft-IIS/10.0 X-Powered-By ASP.NET Content-Length 103 Content-Type text/html
GET H/1.1	200 OK	favicon.ico dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/	2 KB 0	0ms 0ms	Other image/x-icon	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/favicon.ico Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `9bbf91204e8022d01c859c92c1d9218ac4859de521548856534b48ac2e7849a8` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/details.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Wed, 22 May 2024 20:50:47 GMT Last-Modified Tue, 02 Jan 2024 09:46:58 GMT Server Microsoft-IIS/10.0 ETag "7166fca0603dda1:0" X-Powered-By ASP.NET Content-Type image/x-icon Accept-Ranges bytes Content-Length 2238
GET H/1.1	404 Not Found	RNHouseSansW03-Regular.ttf dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/fonts/ Frame DC47	0 0	185ms 185ms	Font text/html	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/fonts/RNHouseSansW03-Regular.ttf Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/npc.css Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/npc.css Origin https://dmca-blog.azurewebsites.net Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Wed, 22 May 2024 20:50:47 GMT Server Microsoft-IIS/10.0 X-Powered-By ASP.NET Content-Length 103 Content-Type text/html

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: NatWest (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
dmca-blog.azurewebsites.net/	1969-12-31 23:59:59	Name: PHPSESSID Value: 38bbpl0cn0d0oa3k99v76su4j2
.dmca-blog.azurewebsites.net/	1969-12-31 23:59:59	Name: ARRAffinity Value: ad26f9a6bd8a60cc0a709ea5aba83deeee69ecdeb9e8ed99f43a1cd50f09889a
.dmca-blog.azurewebsites.net/	1969-12-31 23:59:59	Name: ARRAffinitySameSite Value: ad26f9a6bd8a60cc0a709ea5aba83deeee69ecdeb9e8ed99f43a1cd50f09889a

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/RNHouseSansW03-Bold.woff Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/security_files/RNHouseSansW03-Regular.woff Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/fonts/RNHouseSansW03-Bold.ttf Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/fonts/RNHouseSansW03-Regular.ttf Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

dmca-blog.azurewebsites.net
13.66.226.80
04c45c81e1298e703f3bde9cec27446450294330ae06bd24c9f9343b264462e9
14714f651128eff786763144294b0e7c67529d317ac5371632bbf8fb659866ff
1acd7d03edc5d90866fd012355c352efbb02f38c9334cffd4a9f321b4d713491
1ff54dfa1e63e3d54e14f28c890422042dff8311823588117f8b60b37b0ed705
43a780414ddf2b15e9b47811bbaa8cbfc6cf56d4db65684ed114a1c2a13bc097
4a30e0e808472532909d1fccf26f6034144a153b65e7df8329bfe50aa8f78458
5b5b18035f2e7a1a23feae2bc3235657b1168012a5010a08826755f01773c231
643d4d52a1a24515822f6a30683f901bb5dd16c251d88caece27ab2713457272
75b00a583c89310d12ace059629526ba7cfbb0bd4509ec5750a25fd6ffdd6e12
917942589e5b140755ee83bb4720ca9c1bbf7705f44f51a78ba1ffa635420c50
990f073c20457aa8ecb56a57304e16c90ec7eadb63f25e64932b2f1914054d4a
9bbf91204e8022d01c859c92c1d9218ac4859de521548856534b48ac2e7849a8
d4901081a59d75050d215c08d6fd5370cea9aa1eaea023a176c9b9c26760f221
ef7db794b4a6b5c42d2535919d91fb11da1e5cd1147f35196db382197b35fdee

dmca-blog.azurewebsites.net Open in urlscan Pro 13.66.226.80 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

19 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

78 kBTransfer

242 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

19 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

3 Cookies

4 Console Messages

Indicators

dmca-blog.azurewebsites.net Open in urlscan Pro
13.66.226.80 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

19
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

78 kB
Transfer

242 kB
Size

3
Cookies

19 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!