urlscan.io logo urlscan.io
SecurityTrails logo

www.barclays.secure3form.com Open in urlscan Pro
91.209.70.91  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://www.barclays.secure3form.com/
Submission: On August 10 via automatic, source certstream-suspicious
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 3 countries across 4 domains to perform 26 HTTP transactions. The main IP is 91.209.70.91, located in Russian Federation and belongs to FISHNET-AS, RU. The main domain is www.barclays.secure3form.com.
TLS certificate: Issued by R3 on August 10th 2021. Valid for: 3 months.
This is the only time www.barclays.secure3form.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Barclays (Banking)

Domain & IP information

IP Address AS Autonomous System
3 91.209.70.91 43317 (FISHNET-AS)
2 104.75.88.194 16625 (AKAMAI-AS)
17 104.111.226.247 16625 (AKAMAI-AS)
1 2001:4de0:ac1... 20446 (HIGHWINDS3)
26 5
Domain Requested by
17 bank.barclays.co.uk www.barclays.secure3form.com
bank.barclays.co.uk
3 www.barclays.secure3form.com www.barclays.secure3form.com
code.jquery.com
2 tags.tiqcdn.com www.barclays.secure3form.com
tags.tiqcdn.com
1 code.jquery.com www.barclays.secure3form.com
26 4

This site contains links to these domains. Also see Links.

Domain
www.barclays.co.uk
status.uk.barclays
www.bsigroup.com
www.iso.org
www.fscs.org.uk
Subject Issuer Validity Valid
www.barclays.secure3form.com
R3		 2021-08-10 -
2021-11-08		 3 months crt.sh
*.tiqcdn.com
DigiCert SHA2 Secure Server CA		 2021-04-19 -
2022-04-27		 a year crt.sh
bank.barclays.co.uk
Entrust Certification Authority - L1M		 2021-01-08 -
2021-09-10		 8 months crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA		 2021-07-14 -
2022-08-14		 a year crt.sh

This page contains 1 frames:

Primary Page: https://www.barclays.secure3form.com/
Frame ID: 07AC8054EE1F55D5A59E635AF164E672
Requests: 28 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • script /angular.*\.js/i
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Overall confidence: 100%
Detected patterns
  • script /\/s[_-]code.*\.js/i
Overall confidence: 100%
Detected patterns
  • script /^(?:https?:)?\/\/tags\.tiqcdn\.com\//i
Overall confidence: 100%
Detected patterns
  • script /jquery[.-]([\d.]*\d)[^/]*\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

26
Requests

88 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

5
IPs

3
Countries

771 kB
Transfer

2304 kB
Size

3
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

26 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.barclays.secure3form.com/ 		69 KB
69 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.barclays.secure3form.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
91.209.70.91 , Russian Federation, ASN43317 (FISHNET-AS, RU),
Reverse DNS
Software
Apache /
Resource Hash
d870eda8b8c5f3c2254199a30e23030f6db054144c8d00484b5bd6bbcd7b07dc

Request headers

Host
www.barclays.secure3form.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 10 Aug 2021 11:42:03 GMT
Server
Apache
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
utag.js
tags.tiqcdn.com/utag/barclaysuk/barclays-olb/prod/ 		160 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/barclaysuk/barclays-olb/prod/utag.js
Requested by
Host: www.barclays.secure3form.com
URL: https://www.barclays.secure3form.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-194.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
e7ae57b0d2e853b851ade7878dce6dfe2f64cbbee88273d5b68049b1dc939d72

Request headers

Referer
https://www.barclays.secure3form.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 10 Aug 2021 11:42:03 GMT
content-encoding
gzip
last-modified
Thu, 04 Feb 2021 13:55:27 GMT
server
AkamaiNetStorage
etag
"9094cf95c302ead85a60b9a54b1fed2a:1612446926.806536"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=300
accept-ranges
bytes
content-length
29228
expires
Tue, 10 Aug 2021 11:47:03 GMT
bdlLogin-dss-jquery-libraries.min.js
www.barclays.secure3form.com/authlogin/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://www.barclays.secure3form.com/authlogin/bdlLogin-dss-jquery-libraries.min.js?v=1606745934868
Requested by
Host: www.barclays.secure3form.com
URL: https://www.barclays.secure3form.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
91.209.70.91 , Russian Federation, ASN43317 (FISHNET-AS, RU),
Reverse DNS
Software
Apache /
Resource Hash

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
www.barclays.secure3form.com
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://www.barclays.secure3form.com/
Connection
keep-alive
Referer
https://www.barclays.secure3form.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 10 Aug 2021 11:42:03 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=99
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
polyfill.wp.js
bank.barclays.co.uk//authlogin/lib/ 		98 KB
98 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bank.barclays.co.uk//authlogin/lib/polyfill.wp.js
Requested by
Host: www.barclays.secure3form.com
URL: https://www.barclays.secure3form.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.226.247 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-226-247.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
02e9e14e36ad05a2a528e81898868b7c9fb738980d111599f4460dc7926aa1b0
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://www.barclays.secure3form.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
last-modified
Thu, 11 Feb 2021 14:44:55 GMT
etag
"18659-602542e7"
content-type
application/x-javascript
date
Tue, 10 Aug 2021 11:42:03 GMT
accept-ranges
bytes
content-length
99929
x-ua-compatible
chrome=IE6
angular.min.js
bank.barclays.co.uk//js/myBarclays/vendor/angular/ 		105 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bank.barclays.co.uk//js/myBarclays/vendor/angular/angular.min.js
Requested by
Host: www.barclays.secure3form.com
URL: https://www.barclays.secure3form.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.226.247 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-226-247.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
f8ea0e980b8bdca260f9f81d0e98360c3080fdc7fd3992cf611e05701e2e8a36
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://www.barclays.secure3form.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
content-encoding
gzip
last-modified
Fri, 18 Jun 2021 11:06:30 GMT
etag
"9bd6-60cc7e36"
vary
accept-encoding
content-type
application/x-javascript
date
Tue, 10 Aug 2021 11:42:03 GMT
accept-ranges
bytes
content-length
39894
x-ua-compatible
chrome=IE6
angular-route.min.js
bank.barclays.co.uk//js/myBarclays/vendor/angular/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bank.barclays.co.uk//js/myBarclays/vendor/angular/angular-route.min.js
Requested by
Host: www.barclays.secure3form.com
URL: https://www.barclays.secure3form.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.226.247 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-226-247.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
225667650d0be401e4cb148aa2dea5ad695c19563d2f94cfa20aa7082c5c966a
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://www.barclays.secure3form.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
content-encoding
gzip
last-modified
Fri, 18 Jun 2021 11:06:30 GMT
etag
"75b-60cc7e36"
vary
accept-encoding
content-type
application/x-javascript
date
Tue, 10 Aug 2021 11:42:03 GMT
accept-ranges
bytes
content-length
1883
x-ua-compatible
chrome=IE6
angular-sanitize.min.js
bank.barclays.co.uk//js/myBarclays/vendor/angular/ 		4 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bank.barclays.co.uk//js/myBarclays/vendor/angular/angular-sanitize.min.js
Requested by
Host: www.barclays.secure3form.com
URL: https://www.barclays.secure3form.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.226.247 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-226-247.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
20318e023853ac4d3e1f231b0532de4c39d83c629a4155756c021e57825dc884
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://www.barclays.secure3form.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
content-encoding
gzip
last-modified
Fri, 18 Jun 2021 11:06:30 GMT
etag
"96c-60cc7e36"
vary
accept-encoding
content-type
application/x-javascript
date
Tue, 10 Aug 2021 11:42:03 GMT
accept-ranges
bytes
content-length
2412
x-ua-compatible
chrome=IE6
bdlLogin-rolb-dss.min.js
bank.barclays.co.uk//authlogin/ 		254 KB
66 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bank.barclays.co.uk//authlogin/bdlLogin-rolb-dss.min.js?v=1606745934868
Requested by
Host: www.barclays.secure3form.com
URL: https://www.barclays.secure3form.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.226.247 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-226-247.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
1d3fef663505e5ce8eccf28b01bb423260210ff6e57c33853adf372194c3f593
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://www.barclays.secure3form.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
content-encoding
gzip
last-modified
Wed, 14 Jul 2021 08:43:49 GMT
etag
"10572-60eea3c5"
vary
accept-encoding
content-type
application/x-javascript
date
Tue, 10 Aug 2021 11:42:03 GMT
accept-ranges
bytes
content-length
66930
x-ua-compatible
chrome=IE6
bdlLogin-libraries.min.js
bank.barclays.co.uk//authlogin/ 		71 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bank.barclays.co.uk//authlogin/bdlLogin-libraries.min.js?v=1606745934868
Requested by
Host: www.barclays.secure3form.com
URL: https://www.barclays.secure3form.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.226.247 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-226-247.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
23258114961c94563c3e7df66f059d487995e01f4ce666f2e5b84f1c499e63cc
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://www.barclays.secure3form.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
content-encoding
gzip
last-modified
Wed, 14 Jul 2021 08:43:49 GMT
etag
"6a7a-60eea3c5"
vary
accept-encoding
content-type
application/x-javascript
date
Tue, 10 Aug 2021 11:42:03 GMT
accept-ranges
bytes
content-length
27258
x-ua-compatible
chrome=IE6
bdlLogin-rolb-app.min.js
bank.barclays.co.uk//authlogin/ 		273 KB
76 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bank.barclays.co.uk//authlogin/bdlLogin-rolb-app.min.js?v=1606745934868
Requested by
Host: www.barclays.secure3form.com
URL: https://www.barclays.secure3form.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.226.247 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-226-247.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
7a03514925d0b3b17e6c476b86d2a5b93a90f4df6a3252364015761157c4e285
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://www.barclays.secure3form.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
content-encoding
gzip
last-modified
Wed, 14 Jul 2021 08:43:49 GMT
etag
"12cd9-60eea3c5"
vary
accept-encoding
content-type
application/x-javascript
date
Tue, 10 Aug 2021 11:42:04 GMT
accept-ranges
bytes
content-length
77017
x-ua-compatible
chrome=IE6
s_codecookies.js
bank.barclays.co.uk//js/sitecatalyst/ 		52 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bank.barclays.co.uk//js/sitecatalyst/s_codecookies.js
Requested by
Host: www.barclays.secure3form.com
URL: https://www.barclays.secure3form.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.226.247 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-226-247.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
d54713b5dfe6663cc74f2c81ca876be2ca0c0e70917e366250c6605bbe84c251
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://www.barclays.secure3form.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
content-encoding
gzip
last-modified
Fri, 18 Jun 2021 11:06:31 GMT
etag
"4ef2-60cc7e37"
vary
accept-encoding
content-type
application/x-javascript
date
Tue, 10 Aug 2021 11:42:03 GMT
accept-ranges
bytes
content-length
20210
x-ua-compatible
chrome=IE6
6bb5a42d.min.js
bank.barclays.co.uk//js/bc/2.8.1/ 		340 KB
88 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bank.barclays.co.uk//js/bc/2.8.1/6bb5a42d.min.js
Requested by
Host: www.barclays.secure3form.com
URL: https://www.barclays.secure3form.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.226.247 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-226-247.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
52aa6e020c0bb612dd9221d801a3ebda86836e047dbd30e21069248669061cbb
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://www.barclays.secure3form.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
content-encoding
gzip
last-modified
Fri, 18 Jun 2021 11:06:22 GMT
etag
"15e7f-60cc7e2e"
vary
accept-encoding
content-type
application/x-javascript
date
Tue, 10 Aug 2021 11:42:03 GMT
accept-ranges
bytes
content-length
89727
x-ua-compatible
chrome=IE6
jquery-3.5.1.js
code.jquery.com/ 		281 KB
83 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.5.1.js
Requested by
Host: www.barclays.secure3form.com
URL: https://www.barclays.secure3form.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac18::1:a:1b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
nginx /
Resource Hash
416a3b2c3bf16d64f6b5b6d0f7b079df2267614dd6847fc2f3271b4409233c37

Request headers

Origin
https://www.barclays.secure3form.com
Referer
https://www.barclays.secure3form.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 10 Aug 2021 11:42:03 GMT
content-encoding
gzip
last-modified
Mon, 04 May 2020 23:02:39 GMT
server
nginx
etag
W/"5eb09f0f-4638e"
vary
Accept-Encoding
x-hw
1628595723.dop165.fr8.t,1628595723.cds262.fr8.hc,1628595723.cds234.fr8.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
84374
rolb-theme-2-0.css
bank.barclays.co.uk/authlogin/css/ 		333 KB
69 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://bank.barclays.co.uk/authlogin/css/rolb-theme-2-0.css?v=1606745934868
Requested by
Host: www.barclays.secure3form.com
URL: https://www.barclays.secure3form.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.226.247 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-226-247.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
073f5b7ffebc61098e2b649f2067252032ff1865167948af2a8847f5d8f760f6
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://www.barclays.secure3form.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
content-encoding
gzip
last-modified
Wed, 14 Jul 2021 08:43:50 GMT
etag
"11062-60eea3c6"
vary
accept-encoding
content-type
text/css
date
Tue, 10 Aug 2021 11:42:03 GMT
accept-ranges
bytes
content-length
69730
x-ua-compatible
chrome=IE6
authlogin-bdl.min.css
bank.barclays.co.uk/authlogin/css/ 		45 KB
45 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://bank.barclays.co.uk/authlogin/css/authlogin-bdl.min.css?v=1606745934868
Requested by
Host: www.barclays.secure3form.com
URL: https://www.barclays.secure3form.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.226.247 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-226-247.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
c7588e66ab3dfc34b4beda8e07aa630e5a764a001d7568244ef963c3620f3365
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://www.barclays.secure3form.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
last-modified
Thu, 11 Feb 2021 14:45:04 GMT
etag
"b345-602542f0"
content-type
text/css
date
Tue, 10 Aug 2021 11:42:03 GMT
accept-ranges
bytes
content-length
45893
x-ua-compatible
chrome=IE6
1321217916907-bsikitemarklogo.png
bank.barclays.co.uk/OLB/A/Content/Images/ 		13 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bank.barclays.co.uk/OLB/A/Content/Images/1321217916907-bsikitemarklogo.png
Requested by
Host: www.barclays.secure3form.com
URL: https://www.barclays.secure3form.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.226.247 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-226-247.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
90326fd2ae35b37049ca9b624acb2b698be96a509f3619cf647d686433eaaa15
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://www.barclays.secure3form.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
last-modified
Thu, 13 Jun 2019 15:08:21 GMT
etag
"34cc-5d0266e5"
content-type
image/png
date
Tue, 10 Aug 2021 11:42:04 GMT
accept-ranges
bytes
content-length
13516
x-ua-compatible
chrome=IE6
1321217916492-iso27001footer.JPG
bank.barclays.co.uk/OLB/A/Content/Images/ 		24 KB
24 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bank.barclays.co.uk/OLB/A/Content/Images/1321217916492-iso27001footer.JPG
Requested by
Host: www.barclays.secure3form.com
URL: https://www.barclays.secure3form.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.226.247 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-226-247.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
03c2526a71f8b178491bca3226f69d72a28aa606133527c00b28adab490f940d
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://www.barclays.secure3form.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
last-modified
Thu, 13 Jun 2019 15:10:15 GMT
etag
"5e04-5d026757"
content-type
image/jpeg
date
Tue, 10 Aug 2021 11:42:04 GMT
accept-ranges
bytes
content-length
24068
x-ua-compatible
chrome=IE6
1321217918424-cyberfooter.jpg
bank.barclays.co.uk/OLB/A/Content/Images/ 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bank.barclays.co.uk/OLB/A/Content/Images/1321217918424-cyberfooter.jpg
Requested by
Host: www.barclays.secure3form.com
URL: https://www.barclays.secure3form.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.226.247 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-226-247.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
effa2f551ae3f572384002e36028aa1e85544462f42c28065731284e8f81bfcd
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://www.barclays.secure3form.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
last-modified
Thu, 13 Jun 2019 15:09:04 GMT
etag
"2406-5d026710"
content-type
image/jpeg
date
Tue, 10 Aug 2021 11:42:04 GMT
accept-ranges
bytes
content-length
9222
x-ua-compatible
chrome=IE6
login-fscs.png
bank.barclays.co.uk/OLB/A/Content/Images/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bank.barclays.co.uk/OLB/A/Content/Images/login-fscs.png
Requested by
Host: www.barclays.secure3form.com
URL: https://www.barclays.secure3form.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.226.247 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-226-247.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
2aa89b0d3ed189360406952265076a3f79ea08b045f2e07d7d71e3c38982533e
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://www.barclays.secure3form.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
last-modified
Wed, 09 Sep 2020 09:55:15 GMT
etag
"152b-5f58a683"
content-type
image/png
date
Tue, 10 Aug 2021 11:42:04 GMT
accept-ranges
bytes
content-length
5419
x-ua-compatible
chrome=IE6
bdlLogin.bootstrap.min.js
bank.barclays.co.uk/authlogin/ 		19 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bank.barclays.co.uk/authlogin/bdlLogin.bootstrap.min.js?v=1606745934868
Requested by
Host: www.barclays.secure3form.com
URL: https://www.barclays.secure3form.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.226.247 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-226-247.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fca63a7a3eb5d2b14c03d129964c75182fbedf12ac40f123ea52daa277d5f4a2
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://www.barclays.secure3form.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
content-encoding
gzip
last-modified
Wed, 14 Jul 2021 08:43:49 GMT
etag
"ce1-60eea3c5"
vary
accept-encoding
content-type
application/x-javascript
date
Tue, 10 Aug 2021 11:42:04 GMT
accept-ranges
bytes
content-length
3297
x-ua-compatible
chrome=IE6
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
91a06213190743f440aa3411f1393afaf3de8b3b6309d6677fb7680248f09e91

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=US-ASCII
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e111be4c24fc0743ca7eb1c4873a64bb234135b9bea86cabd922a5caabb6c9c6

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=US-ASCII
Padlock_icon.svg
bank.barclays.co.uk/authlogin/img/ 		2 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bank.barclays.co.uk/authlogin/img/Padlock_icon.svg
Requested by
Host: bank.barclays.co.uk
URL: https://bank.barclays.co.uk/authlogin/css/authlogin-bdl.min.css?v=1606745934868
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.226.247 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-226-247.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
b173ff6e97748a8a4e079bf7afa965e4d264fa43a351c4a0bf2c130bc65b4366
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://bank.barclays.co.uk/authlogin/css/authlogin-bdl.min.css?v=1606745934868
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
content-encoding
gzip
last-modified
Wed, 14 Jul 2021 08:43:50 GMT
etag
"2f3-60eea3c6"
vary
accept-encoding
content-type
image/svg+xml
date
Tue, 10 Aug 2021 11:42:04 GMT
accept-ranges
bytes
content-length
755
x-ua-compatible
chrome=IE6
expert-sans-regular.woff
bank.barclays.co.uk/authlogin/css/fonts/ 		0
0
expert-sans-light.woff
bank.barclays.co.uk/authlogin/css/fonts/ 		0
0
0e2cfb8a-1df2-458e-8623-7d96ce2e86cd
https://www.barclays.secure3form.com/ 		139 KB
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.barclays.secure3form.com/0e2cfb8a-1df2-458e-8623-7d96ce2e86cd
Requested by
Host: www.barclays.secure3form.com
URL: https://www.barclays.secure3form.com/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ed6604f7293bcfe87ee03795e418c40cb40a96444a320d45bb97dfdcf40a14b8

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Length
142652
Content-Type
application/javascript
utag.v.js
tags.tiqcdn.com/utag/tiqapp/ 		2 B
202 B 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=barclaysuk/barclays-olb/202102041355&cb=1628595724246
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/barclaysuk/barclays-olb/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-194.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

Referer
https://www.barclays.secure3form.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 10 Aug 2021 11:42:04 GMT
last-modified
Thu, 14 Apr 2016 16:57:51 GMT
server
AkamaiNetStorage
etag
"7bc0ee636b3b83484fc3b9348863bd22:1460653071"
content-type
application/x-javascript
cache-control
max-age=600
accept-ranges
bytes
content-length
2
expires
Tue, 10 Aug 2021 11:52:04 GMT
activity.php
www.barclays.secure3form.com/files/ 		312 B
519 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.barclays.secure3form.com/files/activity.php
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.5.1.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
91.209.70.91 , Russian Federation, ASN43317 (FISHNET-AS, RU),
Reverse DNS
Software
Apache /
Resource Hash
97b55a94195e0f126d3579fb882ab290818ad8921e393ee5cd9d23a3c77c9b69

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
www.barclays.secure3form.com
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
empty
X-Requested-With
XMLHttpRequest
Connection
keep-alive
Referer
https://www.barclays.secure3form.com/
Accept
*/*
Referer
https://www.barclays.secure3form.com/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 10 Aug 2021 11:42:07 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=98
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
bank.barclays.co.uk
URL
https://bank.barclays.co.uk/authlogin/css/fonts/expert-sans-regular.woff
Domain
bank.barclays.co.uk
URL
https://bank.barclays.co.uk/authlogin/css/fonts/expert-sans-light.woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Barclays (Banking)

111 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated boolean| utag_condload object| utag boolean| __tealium_twc_switch object| utag_cfg_ovrd object| __core-js_shared__ object| core object| global object| System function| asap function| Observable function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill object| angular number| ng339 function| _ function| getElementsByClassName function| getTextContent function| scFixed function| scFixed1Tag function| scAppendWholeTag function| scLowRankTag function| scProductsTag function| scSetLinkNameTag function| scCombinedP123 function| scRemap function| tagPageView function| tagAjaxContent function| tagQueryContents function| setFromClickTagsFTB function| scLinkTrack function| scLinkTrackError function| dcsMultiTrack function| scMeta function| scSetInitial function| scSetDerived function| isLoginPage function| isHomePage function| scSetHelpCardButtons function| scCleanUpEvents function| scLoginPagesTracking function| scCleanUp function| scSetValidationErrorMessage function| fireLoadEvent function| scSetErrorMessage function| scSetErrorServiceMessage function| scSetImpressions function| scSetLOGIN_METHOD function| scSetLOGIN_MECHANISM function| scSetLoginEvents function| scSetDeepLink function| scSetdcsuri function| scSetProducts function| scSetView function| getProp34 function| scSetPurchaseTracking function| scSetActivityTracking function| scSetLoginReg function| scSetPageName function| isMultipleSavedUsers function| scSetEvents function| scSetDcsvid function| scBarclaysCookieConsent function| scMapTag function| scSetTag function| scAddTag function| scUpdateLinkTrack function| scSaveBasePageName function| scRestoreBasePageName function| scSaveTakeoverPageName function| scRestoreTakeoverPageName object| AppName object| authloginDigitalData string| s_account object| dcs2sc string| scBasePageName string| scTakeoverPageName object| _self object| Prism string| digitalDataDeviceBuildId undefined| WebAnalytics function| cookieCat2Status undefined| s undefined| s_code undefined| s_objectID undefined| s_doPlugins undefined| s_gi undefined| s_giqf object| cdApi function| $ function| jQuery boolean| ie8 object| browser_detect function| mboxDefine function| mboxUpdate string| pathref object| dataLayer number| interval function| heartbeat

3 Cookies

Domain/Path Name / Value
.secure3form.com/ Name: bmuid
Value: 1628595724130-8AC14C54-C790-4CD5-B3D3-BAF949254F3C
.secure3form.com/ Name: cdContextId
Value: 1
.secure3form.com/ Name: utag_main
Value: v_id:017b2fde9e7b001cc3f4ad4d8b6e00072002506a00b08$_sn:1$_se:1$_ss:1$_st:1628597523900$ses_id:1628595723900%3Bexp-session$_pn:1%3Bexp-session

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bank.barclays.co.uk
code.jquery.com
tags.tiqcdn.com
www.barclays.secure3form.com
bank.barclays.co.uk
104.111.226.247
104.75.88.194
2001:4de0:ac18::1:a:1b
91.209.70.91
02e9e14e36ad05a2a528e81898868b7c9fb738980d111599f4460dc7926aa1b0
03c2526a71f8b178491bca3226f69d72a28aa606133527c00b28adab490f940d
073f5b7ffebc61098e2b649f2067252032ff1865167948af2a8847f5d8f760f6
1d3fef663505e5ce8eccf28b01bb423260210ff6e57c33853adf372194c3f593
20318e023853ac4d3e1f231b0532de4c39d83c629a4155756c021e57825dc884
225667650d0be401e4cb148aa2dea5ad695c19563d2f94cfa20aa7082c5c966a
23258114961c94563c3e7df66f059d487995e01f4ce666f2e5b84f1c499e63cc
2aa89b0d3ed189360406952265076a3f79ea08b045f2e07d7d71e3c38982533e
416a3b2c3bf16d64f6b5b6d0f7b079df2267614dd6847fc2f3271b4409233c37
52aa6e020c0bb612dd9221d801a3ebda86836e047dbd30e21069248669061cbb
7a03514925d0b3b17e6c476b86d2a5b93a90f4df6a3252364015761157c4e285
90326fd2ae35b37049ca9b624acb2b698be96a509f3619cf647d686433eaaa15
91a06213190743f440aa3411f1393afaf3de8b3b6309d6677fb7680248f09e91
97b55a94195e0f126d3579fb882ab290818ad8921e393ee5cd9d23a3c77c9b69
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
b173ff6e97748a8a4e079bf7afa965e4d264fa43a351c4a0bf2c130bc65b4366
c7588e66ab3dfc34b4beda8e07aa630e5a764a001d7568244ef963c3620f3365
d54713b5dfe6663cc74f2c81ca876be2ca0c0e70917e366250c6605bbe84c251
d870eda8b8c5f3c2254199a30e23030f6db054144c8d00484b5bd6bbcd7b07dc
e111be4c24fc0743ca7eb1c4873a64bb234135b9bea86cabd922a5caabb6c9c6
e7ae57b0d2e853b851ade7878dce6dfe2f64cbbee88273d5b68049b1dc939d72
ed6604f7293bcfe87ee03795e418c40cb40a96444a320d45bb97dfdcf40a14b8
effa2f551ae3f572384002e36028aa1e85544462f42c28065731284e8f81bfcd
f8ea0e980b8bdca260f9f81d0e98360c3080fdc7fd3992cf611e05701e2e8a36
fca63a7a3eb5d2b14c03d129964c75182fbedf12ac40f123ea52daa277d5f4a2