_wildcard_.automundogarage.com Open in urlscan Pro
50.6.138.110 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://pyndele.com/nitu.php
Effective URL:
https://_wildcard_.automundogarage.com/nab/index.php
Submission: On July 22 via manual (July 22nd 2024, 9:33:18 am UTC) from LT — Scanned from DE

Summary HTTP 3 Redirects Links 5 Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 3 HTTP transactions. The main IP is 50.6.138.110, located in United States and belongs to NETWORK-SOLUTIONS-HOSTING, US. The main domain is _wildcard_.automundogarage.com.
TLS certificate: Issued by R10 on June 7th 2024. Valid for: 3 months.

This is the only time _wildcard_.automundogarage.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: NAB Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
2 2	154.41.228.230 154.41.228.230	47583 (AS-HOSTINGER) (AS-HOSTINGER)
1	50.6.138.110 50.6.138.110	19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING)
1	95.101.27.121 95.101.27.121	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	52.223.40.198 52.223.40.198	16509 (AMAZON-02) (AMAZON-02)
3	4

2 154.41.228.230 (Phoenix, United States) 2 redirects

ASN47583 (AS-HOSTINGER, CY)

pyndele.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 50.6.138.110 (United States)

ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: 50-6-138-110.unifiedlayer.com

_wildcard_.automundogarage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 95.101.27.121 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a95-101-27-121.deploy.static.akamaitechnologies.com

www.nab.com.au	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.223.40.198 (United States)

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	pyndele.com 2 redirects pyndele.com	484 B
1	adsrvr.org match.adsrvr.org — Cisco Umbrella Rank: 505	149 B
1	nab.com.au www.nab.com.au — Cisco Umbrella Rank: 539917	13 KB
1	automundogarage.com _wildcard_.automundogarage.com	1 MB
3	4

	Domain	Requested by
2	pyndele.com	2 redirects
1	match.adsrvr.org	srcdoc
1	www.nab.com.au	srcdoc
1	_wildcard_.automundogarage.com
3	4

This site contains links to these domains. Also see Links.

Domain
www.nab.com.au
ib.nab.com.au

Subject Issuer	Validity	Valid
*.automundogarage.com R10	`2024-06-07` - `2024-09-05`	3 months	crt.sh
www.nab.com.au Entrust Certification Authority - L1M	`2024-04-24` - `2024-10-28`	6 months	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2024-04-23` - `2025-05-25`	a year	crt.sh

This page contains 3 frames:

Primary Page: https://_wildcard_.automundogarage.com/nab/index.php
Frame ID: E1ED83BA6E33C8D4CF3E266C8274E751
Requests: 8 HTTP requests in this frame

Frame: https://www.nab.com.au/personal/online-banking/nab-internet-banking/ib-login-banner/_jcr_content/root/responsivegrid/section_container_co/responsivegrid/feature_container_co/responsivegrid/feature_content_secondary/image.coreimg.95.512.jpeg/1669738874750/red-star-decorative-iblogout-500x500.jpeg
Frame ID: 6F3158F5650698AFDCCF5719089740D3
Requests: 4 HTTP requests in this frame

Frame: https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=ea581b1f-99ce-43b9-974b-4d0cba4b806a&google_gid=CAESEJREOPm-mPQcebxAFJ60FO0&google_cver=1
Frame ID: 27D5FE5B45B8D3D64C8E0CBA019ADA81
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

NAB Internet Banking

Page URL History Show full URLs

http://pyndele.com/nitu.php HTTP 307
https://pyndele.com/nitu.php HTTP 302
https://_wildcard_.automundogarage.com/nab/index.php HTTP 307
http://pyndele.com/nitu.php HTTP 302
https://_wildcard_.automundogarage.com/nab/index.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

3
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

1448 kB
Transfer

3875 kB
Size

1
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: https://www.nab.com.au/personal/online-banking/nab-internet-banking/sms-security
Title: Help

Search URL Search Domain Scan URL

URL: https://www.nab.com.au/about-us/security
Title: Security

Search URL Search Domain Scan URL

URL: https://www.nab.com.au/contact-us
Title: Contact us

Search URL Search Domain Scan URL

URL: https://www.nab.com.au/locations
Title: Locate us

Search URL Search Domain Scan URL

URL: https://ib.nab.com.au/#standardLink
Title: Register now

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://pyndele.com/nitu.php HTTP 307
https://pyndele.com/nitu.php HTTP 302
https://_wildcard_.automundogarage.com/nab/index.php HTTP 307
http://pyndele.com/nitu.php HTTP 302
https://_wildcard_.automundogarage.com/nab/index.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions
10 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request index.php Show response
_wildcard_.automundogarage.com/nab/
Redirect Chain

http://pyndele.com/nitu.php
https://pyndele.com/nitu.php
https://_wildcard_.automundogarage.com/nab/index.php
http://pyndele.com/nitu.php
https://_wildcard_.automundogarage.com/nab/index.php

3 MB
1 MB

980ms
979ms

Document
text/html

50.6.138.110
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://_wildcard_.automundogarage.com/nab/index.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 50.6.138.110 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 50-6-138-110.unifiedlayer.com
Software: Apache /
Resource Hash: 8c986277e6573a83f66177626e738030280d2a78399ed7e6ca34334dd23028f2

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 22 Jul 2024 09:33:10 GMT
server: Apache
vary: Accept-Encoding

Redirect headers

connection: Keep-Alive
content-length: 0
content-type: text/html; charset=UTF-8
date: Mon, 22 Jul 2024 09:33:10 GMT
location: https://_wildcard_.automundogarage.com/nab/index.php
server: LiteSpeed

GET
DATA 200
OK truncated
/ 17 KB
17 KB Font
font/woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 760a5ecb51ae9bee28469d621b6604d62c8c7c4685c307aa36bcd2d7d28763b6

Request headers

Referer
Origin: https://_wildcard_.automundogarage.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: font/woff

GET
DATA 200
OK truncated
/ 9 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ce56c017a4b04dd507163f35d6c09d6c28ca91b7d468fd808cdc3a50358cad1c

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 195 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 02de1f52cd99150184f0d6220900f86a724fe4366f096d280fb12e7a1e44b389

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 123 KB
123 KB Font
font/woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: adfcb007326055dfc42f35bda68fabf69cfb5f3a7c2b57ba3fd013be78d12f53

Request headers

Referer
Origin: https://_wildcard_.automundogarage.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: font/woff

GET
DATA 200
OK truncated
/ 22 KB
22 KB Font
font/woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 67d388dd39127840ca765af955cb892125b87d271e49de699778de98ff527689

Request headers

Referer
Origin: https://_wildcard_.automundogarage.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: font/woff

GET
DATA 200
OK truncated
/ 25 KB
25 KB Font
font/woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c7e96542cb7c5e6455b76d3645823956ba90bfa5591f79b17528de5f95e78483

Request headers

Referer
Origin: https://_wildcard_.automundogarage.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: font/woff

GET
DATA 200
OK truncated
/ 12 KB
12 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f951333e6474d4b7f9cd23d5afea66130b4175f40b88f3b0979d545663d391ec

Request headers

Referer
Origin: https://_wildcard_.automundogarage.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: font/woff2

GET
H2 200 red-star-decorative-iblogout-500x500.jpeg
www.nab.com.au/personal/online-banking/nab-internet-banking/ib-login-banner/_jcr_content/root/responsivegrid/section_container_co/responsivegrid/feature_container_co/responsivegrid/feature_content_... Frame 6F31 13 KB
13 KB 222ms
65ms Image
image/avif 95.101.27.121
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.nab.com.au/personal/online-banking/nab-internet-banking/ib-login-banner/_jcr_content/root/responsivegrid/section_container_co/responsivegrid/feature_container_co/responsivegrid/feature_content_secondary/image.coreimg.95.512.jpeg/1669738874750/red-star-decorative-iblogout-500x500.jpeg

Requested by

Host: srcdoc
URL: about:srcdoc

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.27.121 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-27-121.deploy.static.akamaitechnologies.com

Software

Akamai Image Manager /

Resource Hash

a20c62dd96bc45ef7f052af4f432c69d85774ed319ce35d1c03b58491e1e1fdf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Mon, 22 Jul 2024 09:33:12 GMT
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
x-content-type-options: nosniff
last-modified: Fri, 31 May 2024 01:46:42 GMT
server: Akamai Image Manager
x-origin: default-rule
etag: W/"10b4c-619b627b7eba9"
content-type: image/avif
cache-control: private, no-transform, max-age=289228
content-length: 13240
expires: Thu, 25 Jul 2024 17:53:40 GMT

GET
DATA 200
OK truncated
/ Frame 6F31 45 KB
45 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 401a7f399a463c1b791019b134e745bba7e31cd90b5991ce77d828958b4fbb59

Request headers

Referer
Origin: null
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: application/font-woff

GET
DATA 200
OK truncated
/ Frame 6F31 45 KB
45 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 202cf098b4c0d3d287c6ffad412269d960ba6a7872ecc7bd272d820b1522c708

Request headers

Referer
Origin: null
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: application/font-woff

GET
DATA 200
OK truncated
/ Frame 6F31 45 KB
45 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dc170c8efff8d40eb87be519ea9b38ad16e59ab28bf8d654259232e4c439ec6b

Request headers

Referer
Origin: null
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: application/font-woff

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame 27D5 70 B
149 B 163ms
49ms Image
image/gif 52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=ea581b1f-99ce-43b9-974b-4d0cba4b806a&google_gid=CAESEJREOPm-mPQcebxAFJ60FO0&google_cver=1
Requested by: Host: srcdoc
URL: about:srcdoc
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Mon, 22 Jul 2024 09:33:13 GMT
server: Kestrel
content-length: 70
content-type: image/gif

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: NAB Bank (Banking)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.nab.com.au/	1969-12-31 23:59:59	Name: akacd_www_nab_com_au Value: 3899093591~rv=34~id=a3f51f3e688175c7a7ea691b2fd97628

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

_wildcard_.automundogarage.com
match.adsrvr.org
pyndele.com
www.nab.com.au
154.41.228.230
50.6.138.110
52.223.40.198
95.101.27.121
02de1f52cd99150184f0d6220900f86a724fe4366f096d280fb12e7a1e44b389
202cf098b4c0d3d287c6ffad412269d960ba6a7872ecc7bd272d820b1522c708
401a7f399a463c1b791019b134e745bba7e31cd90b5991ce77d828958b4fbb59
67d388dd39127840ca765af955cb892125b87d271e49de699778de98ff527689
760a5ecb51ae9bee28469d621b6604d62c8c7c4685c307aa36bcd2d7d28763b6
8c986277e6573a83f66177626e738030280d2a78399ed7e6ca34334dd23028f2
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
a20c62dd96bc45ef7f052af4f432c69d85774ed319ce35d1c03b58491e1e1fdf
adfcb007326055dfc42f35bda68fabf69cfb5f3a7c2b57ba3fd013be78d12f53
c7e96542cb7c5e6455b76d3645823956ba90bfa5591f79b17528de5f95e78483
ce56c017a4b04dd507163f35d6c09d6c28ca91b7d468fd808cdc3a50358cad1c
dc170c8efff8d40eb87be519ea9b38ad16e59ab28bf8d654259232e4c439ec6b
f951333e6474d4b7f9cd23d5afea66130b4175f40b88f3b0979d545663d391ec

_wildcard_.automundogarage.com Open in urlscan Pro 50.6.138.110 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

3 Requests

100 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

4 IPs

2 Countries

1448 kBTransfer

3875 kBSize

1 Cookies

5 Outgoing links

Page URL History

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 10 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

1 Cookies

Indicators

_wildcard_.automundogarage.com Open in urlscan Pro
50.6.138.110 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

1448 kB
Transfer

3875 kB
Size

1
Cookies

3 HTTP transactions
10 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!