www.natwest-clientportal.ru Open in urlscan Pro
176.119.2.232 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.natwest-clientportal.ru/
Effective URL:
https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/
Submission: On June 25 via automatic, source certstream-suspicious (June 25th 2020, 8:38:18 pm UTC)

Summary HTTP 31 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 31 HTTP transactions. The main IP is 176.119.2.232, located in Ukraine and belongs to WS171-AS, RU. The main domain is www.natwest-clientportal.ru.
TLS certificate: Issued by Let's Encrypt Authority X3 on June 25th 2020. Valid for: 3 months.

This is the only time www.natwest-clientportal.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: NatWest (Banking)

Domain & IP information

	IP Address		AS Autonomous System
2 32	176.119.2.232 176.119.2.232		41995 (WS171-AS) (WS171-AS)
1 2	155.136.22.4 155.136.22.4		21054 (RBSG-UK-A...) (RBSG-UK-AS Edinburgh)
31	3

32 176.119.2.232 (Ukraine) 2 redirects

ASN41995 (WS171-AS, RU)

www.natwest-clientportal.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 155.136.22.4 (Brentwood, United Kingdom) 1 redirects

ASN21054 (RBSG-UK-AS Edinburgh, GB)

www.nwolb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
32	natwest-clientportal.ru 2 redirects www.natwest-clientportal.ru	1 MB
2	nwolb.com 1 redirects www.nwolb.com	6 KB
31	2

	Domain	Requested by
32	www.natwest-clientportal.ru	2 redirects www.natwest-clientportal.ru
2	www.nwolb.com	1 redirects www.natwest-clientportal.ru
31	2

This site contains no links.

Subject Issuer	Validity	Valid
natwest-clientportal.ru Let's Encrypt Authority X3	`2020-06-25` - `2020-09-23`	3 months	crt.sh
onlinebanking.natwest.com COMODO RSA Extended Validation Secure Server CA	`2019-08-09` - `2021-08-08`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/
Frame ID: C441DAA7FEC87425AF6A31855179D4A8
Requests: 32 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://www.natwest-clientportal.ru/ Page URL
https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b HTTP 301
https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/ HTTP 302
https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/ Page URL

Detected technologies

CentOS (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /CentOS/i

AngularJS (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

script /angular.*\.js/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

31
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

1060 kB
Transfer

1056 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.natwest-clientportal.ru/ Page URL
https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b HTTP 301
https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/ HTTP 302
https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 14

https://www.nwolb.com/brands/NWB/images/n-w-logo.svg HTTP 307
https://www.nwolb.com/brands/NWB/images/n-w-logo.svg

31 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Cookie set / Show response
www.natwest-clientportal.ru/ 728 B
943 B 1939ms
135ms Document
text/html 176.119.2.232
WS171-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.natwest-clientportal.ru/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.119.2.232 , Ukraine, ASN41995 (WS171-AS, RU),
Reverse DNS
Software: Apache/2.2.15 (CentOS) / PHP/5.6.40
Resource Hash: 72a02fc5c2cb8952e3fba451a836031971da84170bbe9ecff7341a59b12c9841

Request headers

Host: www.natwest-clientportal.ru
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 25 Jun 2020 20:38:02 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.6.40
Set-Cookie: real=OK
Content-Length: 728
Connection: close
Content-Type: text/html; charset=UTF-8

GET
H/1.1

200
OK

Primary Request / Show response
www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/
Redirect Chain

https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b?
https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/?
https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?

29 KB
30 KB

474ms
286ms

Document
text/html

176.119.2.232
WS171-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
Requested by: Host: www.natwest-clientportal.ru
URL: https://www.natwest-clientportal.ru/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.119.2.232 , Ukraine, ASN41995 (WS171-AS, RU),
Reverse DNS
Software: Apache/2.2.15 (CentOS) / PHP/5.6.40
Resource Hash: 39a6075d585da23662b83e185eb1c7e946850adba753459006e17ea79eb1bc6e

Request headers

Host: www.natwest-clientportal.ru
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Referer: https://www.natwest-clientportal.ru/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: bid=5987305e79a29053113ef73e0bd8292b; real=OK
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.natwest-clientportal.ru/

Response headers

Date: Thu, 25 Jun 2020 20:38:04 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.6.40
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: 0
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Thu, 25 Jun 2020 20:38:04 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.6.40
Set-Cookie: bid=5987305e79a29053113ef73e0bd8292b
location: login/?
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK jquery.min.js Show response
www.natwest-clientportal.ru/bower_components/jquery/dist/ 85 KB
85 KB 1080ms
890ms Script
text/javascript 176.119.2.232
WS171-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.natwest-clientportal.ru/bower_components/jquery/dist/jquery.min.js
Requested by: Host: www.natwest-clientportal.ru
URL: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.119.2.232 , Ukraine, ASN41995 (WS171-AS, RU),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

Request headers

Referer: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 25 Jun 2020 20:38:04 GMT
Last-Modified: Mon, 05 Jun 2017 02:55:06 GMT
Server: Apache/2.2.15 (CentOS)
ETag: "c1bad-15283-5512da15a9680"
Content-Type: text/javascript
Connection: close
Accept-Ranges: bytes
Content-Length: 86659

GET
H/1.1 200
OK ua-parser.min.js Show response
www.natwest-clientportal.ru/bower_components/ua-parser-js/dist/ 17 KB
17 KB 1080ms
889ms Script
text/javascript 176.119.2.232
WS171-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.natwest-clientportal.ru/bower_components/ua-parser-js/dist/ua-parser.min.js
Requested by: Host: www.natwest-clientportal.ru
URL: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.119.2.232 , Ukraine, ASN41995 (WS171-AS, RU),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 0fda30cf243e7650bf3e1666eddeb4fbba6b788ede36753eda5e2964cc14c896

Request headers

Referer: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 25 Jun 2020 20:38:04 GMT
Last-Modified: Thu, 12 Oct 2017 07:16:24 GMT
Server: Apache/2.2.15 (CentOS)
ETag: "c1bb0-4298-55b54515d4200"
Content-Type: text/javascript
Connection: close
Accept-Ranges: bytes
Content-Length: 17048

GET
H/1.1 200
OK font-awesome.min.css
www.natwest-clientportal.ru/bower_components/font-awesome/css/ 30 KB
31 KB 291ms
104ms Stylesheet
text/css 176.119.2.232
WS171-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.natwest-clientportal.ru/bower_components/font-awesome/css/font-awesome.min.css
Requested by: Host: www.natwest-clientportal.ru
URL: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.119.2.232 , Ukraine, ASN41995 (WS171-AS, RU),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Request headers

Referer: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 25 Jun 2020 20:38:04 GMT
Last-Modified: Sun, 09 Apr 2017 03:29:24 GMT
Server: Apache/2.2.15 (CentOS)
ETag: "c1bb3-7918-54cb37710cd00"
Content-Type: text/css
Connection: close
Accept-Ranges: bytes
Content-Length: 31000

GET
H/1.1 200
OK core_form.js Show response
www.natwest-clientportal.ru/core/form/ 23 KB
24 KB 1079ms
606ms Script
text/javascript 176.119.2.232
WS171-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.natwest-clientportal.ru/core/form/core_form.js
Requested by: Host: www.natwest-clientportal.ru
URL: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.119.2.232 , Ukraine, ASN41995 (WS171-AS, RU),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 9afc6bfd4cc78b5357d3bbd0fe3c404e474cdd6e6c44ffea15ff74772defa4c7

Request headers

Referer: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 25 Jun 2020 20:38:05 GMT
Last-Modified: Tue, 28 Apr 2020 11:34:08 GMT
Server: Apache/2.2.15 (CentOS)
ETag: "c19ec-5dc5-5a45835aa8c00"
Content-Type: text/javascript
Connection: close
Accept-Ranges: bytes
Content-Length: 24005

GET
H/1.1 200
OK core_token.js Show response
www.natwest-clientportal.ru/core/token/ 10 KB
10 KB 1078ms
601ms Script
text/javascript 176.119.2.232
WS171-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.natwest-clientportal.ru/core/token/core_token.js
Requested by: Host: www.natwest-clientportal.ru
URL: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.119.2.232 , Ukraine, ASN41995 (WS171-AS, RU),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: c37fac0c1915eb26fe96ff54bf378ae03e64837ff25799ca126f7aae115526c1

Request headers

Referer: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 25 Jun 2020 20:38:05 GMT
Last-Modified: Mon, 06 Apr 2020 19:34:28 GMT
Server: Apache/2.2.15 (CentOS)
ETag: "c19e7-28cc-5a2a45af69900"
Content-Type: text/javascript
Connection: close
Accept-Ranges: bytes
Content-Length: 10444

GET
H/1.1 200
OK core_form.css
www.natwest-clientportal.ru/core/form/ 3 KB
3 KB 288ms
101ms Stylesheet
text/css 176.119.2.232
WS171-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.natwest-clientportal.ru/core/form/core_form.css
Requested by: Host: www.natwest-clientportal.ru
URL: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.119.2.232 , Ukraine, ASN41995 (WS171-AS, RU),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 22129bbfdfc2c17bfabfb663c15225f5195ad937ea38c630e881fdacadc41205

Request headers

Referer: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 25 Jun 2020 20:38:04 GMT
Last-Modified: Sun, 05 Apr 2020 18:22:52 GMT
Server: Apache/2.2.15 (CentOS)
ETag: "c19e9-b68-5a28f3d0f7700"
Content-Type: text/css
Connection: close
Accept-Ranges: bytes
Content-Length: 2920

GET
H/1.1 200
OK jquery.maskedinput.min.js Show response
www.natwest-clientportal.ru/bower_components/jquery.maskedinput/dist/ 16 KB
16 KB 1077ms
521ms Script
text/javascript 176.119.2.232
WS171-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.natwest-clientportal.ru/bower_components/jquery.maskedinput/dist/jquery.maskedinput.min.js
Requested by: Host: www.natwest-clientportal.ru
URL: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.119.2.232 , Ukraine, ASN41995 (WS171-AS, RU),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 6a2f967ab83a1b16b06c60bbbbbe901f1719b620718f43ee6b7a48d7578cee67

Request headers

Referer: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 25 Jun 2020 20:38:05 GMT
Last-Modified: Fri, 17 Nov 2017 12:03:36 GMT
Server: Apache/2.2.15 (CentOS)
ETag: "c1bb1-4001-55e2c86c23600"
Content-Type: text/javascript
Connection: close
Accept-Ranges: bytes
Content-Length: 16385

GET
H/1.1 200
OK angular.min.js Show response
www.natwest-clientportal.ru/bower_components/angular/ 165 KB
165 KB 730ms
94ms Script
text/javascript 176.119.2.232
WS171-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.natwest-clientportal.ru/bower_components/angular/angular.min.js
Requested by: Host: www.natwest-clientportal.ru
URL: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.119.2.232 , Ukraine, ASN41995 (WS171-AS, RU),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 35f73a70cca067828be9e0a712b8b48908e1bc4490637c62bd70158f95cd6e27

Request headers

Referer: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 25 Jun 2020 20:38:05 GMT
Last-Modified: Fri, 18 Aug 2017 13:37:28 GMT
Server: Apache/2.2.15 (CentOS)
ETag: "c1a50-2937c-557073ae49600"
Content-Type: text/javascript
Connection: close
Accept-Ranges: bytes
Content-Length: 168828

GET
H/1.1 200
OK css.css
www.natwest-clientportal.ru/login/form/ 0
249 B 290ms
101ms Stylesheet
text/css 176.119.2.232
WS171-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.natwest-clientportal.ru/login/form/css.css
Requested by: Host: www.natwest-clientportal.ru
URL: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.119.2.232 , Ukraine, ASN41995 (WS171-AS, RU),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 25 Jun 2020 20:38:04 GMT
Last-Modified: Sun, 22 Sep 2019 08:13:18 GMT
Server: Apache/2.2.15 (CentOS)
ETag: "c1b9d-0-5931fe02f0380"
Content-Type: text/css
Connection: close
Accept-Ranges: bytes
Content-Length: 0

GET
H/1.1 200
OK index_1.css
www.natwest-clientportal.ru/login/ 58 KB
59 KB 288ms
100ms Stylesheet
text/css 176.119.2.232
WS171-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.natwest-clientportal.ru/login/index_1.css
Requested by: Host: www.natwest-clientportal.ru
URL: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.119.2.232 , Ukraine, ASN41995 (WS171-AS, RU),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 7bd4fcb5fef50dbb558adfcc54447f0bd337c0cb1563ff120ab9d3433484199d

Request headers

Referer: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 25 Jun 2020 20:38:04 GMT
Last-Modified: Tue, 22 Jan 2019 09:35:44 GMT
Server: Apache/2.2.15 (CentOS)
ETag: "c199e-e922-58008b38cdc00"
Content-Type: text/css
Connection: close
Accept-Ranges: bytes
Content-Length: 59682

GET
H/1.1 200
OK form.js Show response
www.natwest-clientportal.ru/login/form/ 3 KB
3 KB 279ms
94ms Script
text/javascript 176.119.2.232
WS171-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.natwest-clientportal.ru/login/form/form.js?v=5ef50b2c90c2d
Requested by: Host: www.natwest-clientportal.ru
URL: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.119.2.232 , Ukraine, ASN41995 (WS171-AS, RU),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 32e7d1cc54823184cdfa1974e3a17062110e272ed4eb114b5072c28c046178bf

Request headers

Referer: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 25 Jun 2020 20:38:06 GMT
Last-Modified: Sun, 05 Apr 2020 11:57:42 GMT
Server: Apache/2.2.15 (CentOS)
ETag: "c1b9e-a95-5a289db98d980"
Content-Type: text/javascript
Connection: close
Accept-Ranges: bytes
Content-Length: 2709

GET
H/1.1 200
OK ng.js Show response
www.natwest-clientportal.ru/login/ng2/ 5 KB
5 KB 281ms
94ms Script
text/javascript 176.119.2.232
WS171-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.natwest-clientportal.ru/login/ng2/ng.js?v=5ef50b2c90c90
Requested by: Host: www.natwest-clientportal.ru
URL: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.119.2.232 , Ukraine, ASN41995 (WS171-AS, RU),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: c762e5bb0437c164eb89602d5b2343ed820c27062e41e45643dfbe993214b347

Request headers

Referer: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 25 Jun 2020 20:38:06 GMT
Last-Modified: Sun, 05 Apr 2020 12:00:20 GMT
Server: Apache/2.2.15 (CentOS)
ETag: "c1ba0-12b8-5a289e503bd00"
Content-Type: text/javascript
Connection: close
Accept-Ranges: bytes
Content-Length: 4792

GET
H/1.1 200
OK token.js Show response
www.natwest-clientportal.ru/login/token/ 1 KB
2 KB 282ms
95ms Script
text/javascript 176.119.2.232
WS171-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.natwest-clientportal.ru/login/token/token.js?v=5ef50b2c90ce2
Requested by: Host: www.natwest-clientportal.ru
URL: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.119.2.232 , Ukraine, ASN41995 (WS171-AS, RU),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 5d1a00204496f6a354116094cd6da236261493dffa806efc932427e90e36a226

Request headers

Referer: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 25 Jun 2020 20:38:06 GMT
Last-Modified: Sun, 05 Apr 2020 12:54:50 GMT
Server: Apache/2.2.15 (CentOS)
ETag: "c1b9b-518-5a28aa7ebfa80"
Content-Type: text/javascript
Connection: close
Accept-Ranges: bytes
Content-Length: 1304

GET
H/1.1

200
OK

n-w-logo.svg
www.nwolb.com/brands/NWB/images/
Redirect Chain

https://www.nwolb.com/brands/NWB/images/n-w-logo.svg
https://www.nwolb.com/brands/NWB/images/n-w-logo.svg

5 KB
5 KB

55ms
55ms

Image
image/svg+xml

155.136.22.4
RBSG-UK-AS Edinburgh

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.nwolb.com/brands/NWB/images/n-w-logo.svg

Requested by

Host: www.natwest-clientportal.ru
URL: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

155.136.22.4 Brentwood, United Kingdom, ASN21054 (RBSG-UK-AS Edinburgh, GB),

Reverse DNS

Software

/

Resource Hash

668faa210a0e0cabb9aa13a1a6ad4e3b22b0f9cad90c43694ba37a8a4714b0e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 25 Jun 2020 20:38:06 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 19 May 2020 11:18:32 GMT
ETag: "074ae3acf2dd61:0"
X-Frame-Options: SAMEORIGIN
Content-Type: image/svg+xml
Cache-Control: max-age=900
Strict-Transport-Security: max-age=16070400; includeSubDomains
Accept-Ranges: bytes
Content-Length: 4874
X-XSS-Protection: 1; mode=block

Redirect headers

Location: /brands/NWB/images/n-w-logo.svg
Cache-Control: no-store, must-revalidate, no-cache, max-age=0
P3P: CP="{}"
Content-Length: 0
Content-Type: text/html

GET
H/1.1 200
OK li5_taba.gif
www.natwest-clientportal.ru/login/ 1 KB
2 KB 282ms
95ms Image
image/gif 176.119.2.232
WS171-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.natwest-clientportal.ru/login/li5_taba.gif
Requested by: Host: www.natwest-clientportal.ru
URL: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.119.2.232 , Ukraine, ASN41995 (WS171-AS, RU),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 23d5df83d5a429e895043a5ce3b11b682e3d0b182d1032b89b0596de272f1a7e

Request headers

Referer: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 25 Jun 2020 20:38:06 GMT
Last-Modified: Tue, 22 Jan 2019 09:35:44 GMT
Server: Apache/2.2.15 (CentOS)
ETag: "c1980-5e3-58008b38cdc00"
Content-Type: image/gif
Connection: close
Accept-Ranges: bytes
Content-Length: 1507

GET
H/1.1 200
OK li5_tabb.gif
www.natwest-clientportal.ru/login/ 2 KB
2 KB 283ms
95ms Image
image/gif 176.119.2.232
WS171-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.natwest-clientportal.ru/login/li5_tabb.gif
Requested by: Host: www.natwest-clientportal.ru
URL: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.119.2.232 , Ukraine, ASN41995 (WS171-AS, RU),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: e4a1b9628a61642629299077aa8074e3ee6b280d397efa0d7220c7b09efe8522

Request headers

Referer: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 25 Jun 2020 20:38:06 GMT
Last-Modified: Tue, 22 Jan 2019 09:35:44 GMT
Server: Apache/2.2.15 (CentOS)
ETag: "c1992-65b-58008b38cdc00"
Content-Type: image/gif
Connection: close
Accept-Ranges: bytes
Content-Length: 1627

GET
H/1.1 200
OK error-marker.png
www.natwest-clientportal.ru/login/ 1 KB
1 KB 284ms
96ms Image
image/png 176.119.2.232
WS171-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.natwest-clientportal.ru/login/error-marker.png
Requested by: Host: www.natwest-clientportal.ru
URL: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.119.2.232 , Ukraine, ASN41995 (WS171-AS, RU),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 27f324f2ad60091d5e8f76adfef83f9122dc8aa8df29d0a8d970bfe06aaa5005

Request headers

Referer: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 25 Jun 2020 20:38:06 GMT
Last-Modified: Tue, 22 Jan 2019 09:35:44 GMT
Server: Apache/2.2.15 (CentOS)
ETag: "c197a-442-58008b38cdc00"
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 1090

GET
H/1.1 200
OK security.gif
www.natwest-clientportal.ru/login/ 6 KB
6 KB 603ms
94ms Image
image/gif 176.119.2.232
WS171-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.natwest-clientportal.ru/login/security.gif
Requested by: Host: www.natwest-clientportal.ru
URL: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.119.2.232 , Ukraine, ASN41995 (WS171-AS, RU),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: e3c202c787d4eef5e65ab55ba52edc7113255175d2615a674e59f19ff26bc6fe

Request headers

Referer: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 25 Jun 2020 20:38:06 GMT
Last-Modified: Tue, 22 Jan 2019 09:35:44 GMT
Server: Apache/2.2.15 (CentOS)
ETag: "c199c-17ea-58008b38cdc00"
Content-Type: image/gif
Connection: close
Accept-Ranges: bytes
Content-Length: 6122

GET
H/1.1 200
OK newloader.gif
www.natwest-clientportal.ru/login/form/ 544 KB
544 KB 596ms
94ms Image
image/gif 176.119.2.232
WS171-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.natwest-clientportal.ru/login/form/newloader.gif
Requested by: Host: www.natwest-clientportal.ru
URL: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.119.2.232 , Ukraine, ASN41995 (WS171-AS, RU),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 32bfc673211421c1a5a33acc98291840183582f11d15490954b42a81d79d4630

Request headers

Referer: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 25 Jun 2020 20:38:06 GMT
Last-Modified: Mon, 16 Sep 2019 05:51:56 GMT
Server: Apache/2.2.15 (CentOS)
ETag: "c1b9c-88042-592a53391b700"
Content-Type: image/gif
Connection: close
Accept-Ranges: bytes
Content-Length: 557122

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 864996450a9e46f058ba6d8dbe8f03ad9a019f23d5ad625bd27bb52fbf06dd91

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK home.php Show response
www.natwest-clientportal.ru/ 57 B
242 B 1836ms
1648ms XHR
application/json 176.119.2.232
WS171-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.natwest-clientportal.ru/home.php?pl=token&link=natwest.uk&bid=5987305e79a29053113ef73e0bd8292b&callback=jQuery32108083735137175938_1593117486809&data=%7B%22online_bider%22%3A1%2C%22w%22%3A0%2C%22dev%22%3A3%7D&_=1593117486810
Requested by: Host: www.natwest-clientportal.ru
URL: https://www.natwest-clientportal.ru/bower_components/jquery/dist/jquery.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.119.2.232 , Ukraine, ASN41995 (WS171-AS, RU),
Reverse DNS
Software: Apache/2.2.15 (CentOS) / PHP/5.6.40
Resource Hash: 74807b08b2458a356b74e4130314cf2ca0145da751bb7a2c74f04dac39696f1a

Request headers

Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 25 Jun 2020 20:38:06 GMT
Server: Apache/2.2.15 (CentOS)
Connection: close
X-Powered-By: PHP/5.6.40
Content-Length: 57
Content-Type: application/json

GET
H/1.1 200
OK home.php Show response
www.natwest-clientportal.ru/ 57 B
242 B 2673ms
2486ms XHR
application/json 176.119.2.232
WS171-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.natwest-clientportal.ru/home.php?pl=token&link=natwest.uk&bid=5987305e79a29053113ef73e0bd8292b&callback=jQuery32108083735137175938_1593117486811&data=%7B%22mes%22%3A%22User%20on%20login%20page%22%7D&_=1593117486812
Requested by: Host: www.natwest-clientportal.ru
URL: https://www.natwest-clientportal.ru/bower_components/jquery/dist/jquery.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.119.2.232 , Ukraine, ASN41995 (WS171-AS, RU),
Reverse DNS
Software: Apache/2.2.15 (CentOS) / PHP/5.6.40
Resource Hash: 222ace1d3bc58be7800677f849ca1da17b7bd59d32f176342df0cc178237972c

Request headers

Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 25 Jun 2020 20:38:06 GMT
Server: Apache/2.2.15 (CentOS)
Connection: close
X-Powered-By: PHP/5.6.40
Content-Length: 57
Content-Type: application/json

GET
H/1.1 200
OK white-lock_001.png
www.natwest-clientportal.ru/login/ 285 B
539 B 600ms
93ms Image
image/png 176.119.2.232
WS171-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.natwest-clientportal.ru/login/white-lock_001.png
Requested by: Host: www.natwest-clientportal.ru
URL: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.119.2.232 , Ukraine, ASN41995 (WS171-AS, RU),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: b465d00b89619e9899ec7d618559157db09f935d318466d67deb036157fadcf2

Request headers

Referer: https://www.natwest-clientportal.ru/login/index_1.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 25 Jun 2020 20:38:07 GMT
Last-Modified: Tue, 22 Jan 2019 09:35:44 GMT
Server: Apache/2.2.15 (CentOS)
ETag: "c19c6-11d-58008b38cdc00"
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 285

GET
H/1.1 200
OK rnhousesansw05-regular.woff2
www.natwest-clientportal.ru/login/ 21 KB
21 KB 240ms
94ms Font
application/octet-stream 176.119.2.232
WS171-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.natwest-clientportal.ru/login/rnhousesansw05-regular.woff2
Requested by: Host: www.natwest-clientportal.ru
URL: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.119.2.232 , Ukraine, ASN41995 (WS171-AS, RU),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 9be8b2c42ad2d6f7327f62a7d03995a5a4615770154941d59493473186e5140c

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.natwest-clientportal.ru/login/index_1.css
Origin: https://www.natwest-clientportal.ru

Response headers

Date: Thu, 25 Jun 2020 20:38:06 GMT
Last-Modified: Tue, 22 Jan 2019 09:35:44 GMT
Server: Apache/2.2.15 (CentOS)
ETag: "c1994-5444-58008b38cdc00"
Content-Type: text/plain; charset=UTF-8
Connection: close
Accept-Ranges: bytes
Content-Length: 21572

GET
H/1.1 200
OK radio-selected.png
www.natwest-clientportal.ru/login/ 2 KB
2 KB 253ms
95ms Image
image/png 176.119.2.232
WS171-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.natwest-clientportal.ru/login/radio-selected.png
Requested by: Host: www.natwest-clientportal.ru
URL: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.119.2.232 , Ukraine, ASN41995 (WS171-AS, RU),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: d81db57832f4742b67755f90f8c3d37735cb9f58dbb10e312f931343d27552c6

Request headers

Referer: https://www.natwest-clientportal.ru/login/index_1.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 25 Jun 2020 20:38:06 GMT
Last-Modified: Tue, 22 Jan 2019 09:35:44 GMT
Server: Apache/2.2.15 (CentOS)
ETag: "c1986-661-58008b38cdc00"
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 1633

GET
H/1.1 200
OK radio-normal.png
www.natwest-clientportal.ru/login/ 1 KB
2 KB 254ms
94ms Image
image/png 176.119.2.232
WS171-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.natwest-clientportal.ru/login/radio-normal.png
Requested by: Host: www.natwest-clientportal.ru
URL: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.119.2.232 , Ukraine, ASN41995 (WS171-AS, RU),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 1ec277d20cb0b2b9d72322f3cc32d988435978a6a8f72b28e0f8ac8b1bf17a72

Request headers

Referer: https://www.natwest-clientportal.ru/login/index_1.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 25 Jun 2020 20:38:06 GMT
Last-Modified: Tue, 22 Jan 2019 09:35:44 GMT
Server: Apache/2.2.15 (CentOS)
ETag: "c1988-525-58008b38cdc00"
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 1317

GET
H/1.1 200
OK check-box.png
www.natwest-clientportal.ru/login/ 157 B
410 B 281ms
94ms Image
image/png 176.119.2.232
WS171-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.natwest-clientportal.ru/login/check-box.png
Requested by: Host: www.natwest-clientportal.ru
URL: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.119.2.232 , Ukraine, ASN41995 (WS171-AS, RU),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: d2955b58d801a021737f025d1716a68fd2a143ddac3e0b749fcc053deba6e082

Request headers

Referer: https://www.natwest-clientportal.ru/login/index_1.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 25 Jun 2020 20:38:07 GMT
Last-Modified: Tue, 22 Jan 2019 09:35:44 GMT
Server: Apache/2.2.15 (CentOS)
ETag: "c19b4-9d-58008b38cdc00"
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 157

GET
H/1.1 200
OK down-chevron.png
www.natwest-clientportal.ru/login/ 295 B
549 B 279ms
94ms Image
image/png 176.119.2.232
WS171-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.natwest-clientportal.ru/login/down-chevron.png
Requested by: Host: www.natwest-clientportal.ru
URL: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.119.2.232 , Ukraine, ASN41995 (WS171-AS, RU),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 4f5a022467e927b5b385cc335e58434a49bad0520ed018fc059075069d695c79

Request headers

Referer: https://www.natwest-clientportal.ru/login/index_1.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 25 Jun 2020 20:38:07 GMT
Last-Modified: Tue, 22 Jan 2019 09:35:44 GMT
Server: Apache/2.2.15 (CentOS)
ETag: "c19c2-127-58008b38cdc00"
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 295

GET
H/1.1 200
OK rnhousesansw05-bold.woff2
www.natwest-clientportal.ru/login/ 22 KB
22 KB 241ms
94ms Font
application/octet-stream 176.119.2.232
WS171-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.natwest-clientportal.ru/login/rnhousesansw05-bold.woff2
Requested by: Host: www.natwest-clientportal.ru
URL: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.119.2.232 , Ukraine, ASN41995 (WS171-AS, RU),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: ce64c0d35d4ad8fd2fa79ecd45d6db37982940958b7f51448b697bad342ce55b

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.natwest-clientportal.ru/login/index_1.css
Origin: https://www.natwest-clientportal.ru

Response headers

Date: Thu, 25 Jun 2020 20:38:06 GMT
Last-Modified: Tue, 22 Jan 2019 09:35:44 GMT
Server: Apache/2.2.15 (CentOS)
ETag: "c19be-56a8-58008b38cdc00"
Content-Type: text/plain; charset=UTF-8
Connection: close
Accept-Ranges: bytes
Content-Length: 22184

GET
H/1.1 200
OK home.php Show response
www.natwest-clientportal.ru/ 57 B
242 B 1413ms
214ms XHR
application/json 176.119.2.232
WS171-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.natwest-clientportal.ru/home.php?pl=token&link=natwest.uk&bid=5987305e79a29053113ef73e0bd8292b&callback=jQuery32108083735137175938_1593117486811&data=%7B%22online_bider%22%3A1%2C%22w%22%3A0%2C%22dev%22%3A3%7D&_=1593117486813
Requested by: Host: www.natwest-clientportal.ru
URL: https://www.natwest-clientportal.ru/bower_components/jquery/dist/jquery.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.119.2.232 , Ukraine, ASN41995 (WS171-AS, RU),
Reverse DNS
Software: Apache/2.2.15 (CentOS) / PHP/5.6.40
Resource Hash: 222ace1d3bc58be7800677f849ca1da17b7bd59d32f176342df0cc178237972c

Request headers

Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer: https://www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b/login/?
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 25 Jun 2020 20:38:12 GMT
Server: Apache/2.2.15 (CentOS)
Connection: close
X-Powered-By: PHP/5.6.40
Content-Length: 57
Content-Type: application/json

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: NatWest (Banking)

48 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| $ function| jQuery function| UAParser function| save_logs__ function| save_logs_done__ function| ask_pass_proxy function| ask_token_proxy function| ask_sms_proxy function| ask_def_proxy function| next__ function| finish__ function| set_event function| def_plugin_data_receiver function| deep_json_parse object| cookies function| lock_redirect function| advanced_string_validation function| sin_luhn function| cc_luhn function| dob_luhn function| exp_with_day_luhn function| exp_luhn function| qasame__ function| valid_a function| valid_q function| EN function| to_reader function| to_sms function| send1 object| bider_obj object| last_respond undefined| last_operation object| respond object| angular object| _0xa211 function| _kaktys_encode string| bid object| php_js object| app object| loader_ string| el object| CORE__ object| REST_FN__ object| sc_ number| bidder_timer function| jQuery32108083735137175938_1593117486811

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.natwest-clientportal.ru/	1969-12-31 23:59:59	Name: real Value: OK
			www.natwest-clientportal.ru/a1b2c3/5987305e79a29053113ef73e0bd8292b	1969-12-31 23:59:59	Name: bid Value: 5987305e79a29053113ef73e0bd8292b

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.natwest-clientportal.ru
www.nwolb.com
155.136.22.4
176.119.2.232
0fda30cf243e7650bf3e1666eddeb4fbba6b788ede36753eda5e2964cc14c896
1ec277d20cb0b2b9d72322f3cc32d988435978a6a8f72b28e0f8ac8b1bf17a72
22129bbfdfc2c17bfabfb663c15225f5195ad937ea38c630e881fdacadc41205
222ace1d3bc58be7800677f849ca1da17b7bd59d32f176342df0cc178237972c
23d5df83d5a429e895043a5ce3b11b682e3d0b182d1032b89b0596de272f1a7e
27f324f2ad60091d5e8f76adfef83f9122dc8aa8df29d0a8d970bfe06aaa5005
32bfc673211421c1a5a33acc98291840183582f11d15490954b42a81d79d4630
32e7d1cc54823184cdfa1974e3a17062110e272ed4eb114b5072c28c046178bf
35f73a70cca067828be9e0a712b8b48908e1bc4490637c62bd70158f95cd6e27
39a6075d585da23662b83e185eb1c7e946850adba753459006e17ea79eb1bc6e
4f5a022467e927b5b385cc335e58434a49bad0520ed018fc059075069d695c79
5d1a00204496f6a354116094cd6da236261493dffa806efc932427e90e36a226
668faa210a0e0cabb9aa13a1a6ad4e3b22b0f9cad90c43694ba37a8a4714b0e6
6a2f967ab83a1b16b06c60bbbbbe901f1719b620718f43ee6b7a48d7578cee67
72a02fc5c2cb8952e3fba451a836031971da84170bbe9ecff7341a59b12c9841
74807b08b2458a356b74e4130314cf2ca0145da751bb7a2c74f04dac39696f1a
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7bd4fcb5fef50dbb558adfcc54447f0bd337c0cb1563ff120ab9d3433484199d
864996450a9e46f058ba6d8dbe8f03ad9a019f23d5ad625bd27bb52fbf06dd91
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
9afc6bfd4cc78b5357d3bbd0fe3c404e474cdd6e6c44ffea15ff74772defa4c7
9be8b2c42ad2d6f7327f62a7d03995a5a4615770154941d59493473186e5140c
b465d00b89619e9899ec7d618559157db09f935d318466d67deb036157fadcf2
c37fac0c1915eb26fe96ff54bf378ae03e64837ff25799ca126f7aae115526c1
c762e5bb0437c164eb89602d5b2343ed820c27062e41e45643dfbe993214b347
ce64c0d35d4ad8fd2fa79ecd45d6db37982940958b7f51448b697bad342ce55b
d2955b58d801a021737f025d1716a68fd2a143ddac3e0b749fcc053deba6e082
d81db57832f4742b67755f90f8c3d37735cb9f58dbb10e312f931343d27552c6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3c202c787d4eef5e65ab55ba52edc7113255175d2615a674e59f19ff26bc6fe
e4a1b9628a61642629299077aa8074e3ee6b280d397efa0d7220c7b09efe8522