safelog.su Open in urlscan Pro
93.157.63.156 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://safelog.su/
Submission: On August 06 via automatic, source certstream-suspicious (August 6th 2020, 1:18:09 pm UTC)

Summary HTTP 23 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 23 HTTP transactions. The main IP is 93.157.63.156, located in Russian Federation and belongs to NFORCE, NL. The main domain is safelog.su.
TLS certificate: Issued by Let's Encrypt Authority X3 on August 6th 2020. Valid for: 3 months.

This is the only time safelog.su was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: NAB Bank (Banking)

Domain & IP information

	IP Address		AS Autonomous System
22	93.157.63.156 93.157.63.156		43350 (NFORCE) (NFORCE)
23	2

22 93.157.63.156 (Russian Federation)

ASN43350 (NFORCE, NL)
PTR: hr.thegpauk.com

safelog.su	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
22	safelog.su safelog.su	144 KB
0	nab.com.au Failed ib.nab.com.au Failed
23	2

	Domain	Requested by
22	safelog.su	safelog.su
0	ib.nab.com.au Failed	safelog.su
23	2

This site contains links to these domains. Also see Links.

Domain
www.nab.com.au

Subject Issuer	Validity	Valid
safelog.su Let's Encrypt Authority X3	`2020-08-06` - `2020-11-04`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://safelog.su/
Frame ID: B58B41D73E86C632926AEB7407E358D8
Requests: 23 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

23
Requests

96 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

144 kB
Transfer

139 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: http://www.nab.com.au/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

23 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response safelog.su/	16 KB 17 KB	1521ms 17ms	Document text/html	93.157.63.156 NFORCE
General Check archive.org Show headers Download Go to Full URL https://safelog.su/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 93.157.63.156 , Russian Federation, ASN43350 (NFORCE, NL), Reverse DNS hr.thegpauk.com Software Apache / Resource Hash `c71d7e5acf144495ab47a04c96477bc19c80fc80d39a434d0b99ac61771dfdfd` Request headers Host safelog.su Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 06 Aug 2020 13:17:48 GMT Server Apache Last-Modified Wed, 28 Mar 2018 02:29:36 GMT Accept-Ranges bytes Content-Length 16674 Keep-Alive timeout=5, max=80 Connection Keep-Alive Content-Type text/html
GET H/1.1	200 OK	reset011a.css safelog.su/styles/login/	607 B 847 B	19ms 16ms	Stylesheet text/css	93.157.63.156 NFORCE
General Check archive.org Show headers Download Go to Full URL https://safelog.su/styles/login/reset011a.css?id=60 Requested by Host: safelog.su URL: https://safelog.su/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 93.157.63.156 , Russian Federation, ASN43350 (NFORCE, NL), Reverse DNS hr.thegpauk.com Software Apache / Resource Hash `1e61ffdfeb77f256dee30dd9b345b360df85c67bace0dc5092ee0afdc44d3e05` Request headers Referer https://safelog.su/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 06 Aug 2020 13:17:48 GMT Last-Modified Thu, 22 Mar 2018 01:41:56 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=79 Content-Length 607
GET H/1.1	200 OK	_template-styles011a.css safelog.su/styles/login/	20 KB 20 KB	18ms 16ms	Stylesheet text/css	93.157.63.156 NFORCE
General Check archive.org Show headers Download Go to Full URL https://safelog.su/styles/login/_template-styles011a.css?id=60 Requested by Host: safelog.su URL: https://safelog.su/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 93.157.63.156 , Russian Federation, ASN43350 (NFORCE, NL), Reverse DNS hr.thegpauk.com Software Apache / Resource Hash `39a929b4980dd0d19c4ab88cd9ffaa8b475e8917716e58ea9a850f035b1f89da` Request headers Referer https://safelog.su/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 06 Aug 2020 13:17:48 GMT Last-Modified Thu, 22 Mar 2018 01:41:56 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=80 Content-Length 20640
GET H/1.1	200 OK	_content-styles011a.css safelog.su/styles/login/	9 KB 9 KB	35ms 16ms	Stylesheet text/css	93.157.63.156 NFORCE
General Check archive.org Show headers Download Go to Full URL https://safelog.su/styles/login/_content-styles011a.css?id=60 Requested by Host: safelog.su URL: https://safelog.su/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 93.157.63.156 , Russian Federation, ASN43350 (NFORCE, NL), Reverse DNS hr.thegpauk.com Software Apache / Resource Hash `10b169f2b5d4b731c3197b3e3a58d673b5fe9c1dfb4c582bbf46cc8a1a9789a9` Request headers Referer https://safelog.su/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 06 Aug 2020 13:17:48 GMT Last-Modified Thu, 22 Mar 2018 01:41:56 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=78 Content-Length 9107
GET H/1.1	200 OK	added-styles011a.css safelog.su/styles/login/	3 KB 3 KB	48ms 16ms	Stylesheet text/css	93.157.63.156 NFORCE
General Check archive.org Show headers Download Go to Full URL https://safelog.su/styles/login/added-styles011a.css?id=60 Requested by Host: safelog.su URL: https://safelog.su/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 93.157.63.156 , Russian Federation, ASN43350 (NFORCE, NL), Reverse DNS hr.thegpauk.com Software Apache / Resource Hash `42cd7e6840328e01120e434b12d6c669c973c96d0b16aafc82f0116481dd6429` Request headers Referer https://safelog.su/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 06 Aug 2020 13:17:48 GMT Last-Modified Thu, 22 Mar 2018 01:41:56 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=79 Content-Length 2772
GET H/1.1	200 OK	_campaign-styles011a.css safelog.su/styles/login/	1 KB 2 KB	49ms 16ms	Stylesheet text/css	93.157.63.156 NFORCE
General Check archive.org Show headers Download Go to Full URL https://safelog.su/styles/login/_campaign-styles011a.css?id=60 Requested by Host: safelog.su URL: https://safelog.su/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 93.157.63.156 , Russian Federation, ASN43350 (NFORCE, NL), Reverse DNS hr.thegpauk.com Software Apache / Resource Hash `6850f450a8c2ec0d3b2c1531f1283320f5dfff954341865498f66001b81c8501` Request headers Referer https://safelog.su/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 06 Aug 2020 13:17:48 GMT Last-Modified Thu, 22 Mar 2018 01:41:56 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=80 Content-Length 1467
GET H/1.1	200 OK	_ibRedesign-styles011a.css safelog.su/styles/login/	6 KB 6 KB	49ms 16ms	Stylesheet text/css	93.157.63.156 NFORCE
General Check archive.org Show headers Download Go to Full URL https://safelog.su/styles/login/_ibRedesign-styles011a.css?id=60 Requested by Host: safelog.su URL: https://safelog.su/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 93.157.63.156 , Russian Federation, ASN43350 (NFORCE, NL), Reverse DNS hr.thegpauk.com Software Apache / Resource Hash `209b7c6180f8e2023e895d29c6608625c478938409983d775d1de51145ef039c` Request headers Referer https://safelog.su/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 06 Aug 2020 13:17:48 GMT Last-Modified Thu, 22 Mar 2018 01:41:56 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=80 Content-Length 5961
GET H/1.1	200 OK	_print-styles011a.css safelog.su/styles/login/	2 KB 2 KB	49ms 16ms	Stylesheet text/css	93.157.63.156 NFORCE
General Check archive.org Show headers Download Go to Full URL https://safelog.su/styles/login/_print-styles011a.css?id=60 Requested by Host: safelog.su URL: https://safelog.su/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 93.157.63.156 , Russian Federation, ASN43350 (NFORCE, NL), Reverse DNS hr.thegpauk.com Software Apache / Resource Hash `1cf5bc7b9465431a5ece0ba6438290ebc48a5b5c82e89bf91ba9ca216bc2f75c` Request headers Referer https://safelog.su/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 06 Aug 2020 13:17:48 GMT Last-Modified Thu, 22 Mar 2018 01:41:56 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=80 Content-Length 1816
GET H/1.1	404 Not Found	jquery.fancybox-1.3.1011a.css safelog.su/scripts/fancybox/	0 0	49ms 16ms	Stylesheet text/html	93.157.63.156 NFORCE
General Check archive.org Show headers Download Go to Full URL https://safelog.su/scripts/fancybox/jquery.fancybox-1.3.1011a.css?id=60 Requested by Host: safelog.su URL: https://safelog.su/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 93.157.63.156 , Russian Federation, ASN43350 (NFORCE, NL), Reverse DNS hr.thegpauk.com Software Apache / Resource Hash Request headers Referer https://safelog.su/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 06 Aug 2020 13:17:48 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=80 Content-Length 315 Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	logo_nab.png safelog.su/images/login/	5 KB 5 KB	16ms 16ms	Image image/png	93.157.63.156 NFORCE
General Check archive.org Show headers Download Go to Show image Full URL https://safelog.su/images/login/logo_nab.png Requested by Host: safelog.su URL: https://safelog.su/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 93.157.63.156 , Russian Federation, ASN43350 (NFORCE, NL), Reverse DNS hr.thegpauk.com Software Apache / Resource Hash `c8b5c36b604b175f0c6be6b98f40c5b82c05b0a76aadd383a61b0f4fe0b3d264` Request headers Referer https://safelog.su/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 06 Aug 2020 13:17:48 GMT Last-Modified Thu, 22 Mar 2018 01:39:54 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=77 Content-Length 4943
GET H/1.1	200 OK	NAB_Defence.gif safelog.su/images/login/	3 KB 3 KB	21ms 19ms	Image image/gif	93.157.63.156 NFORCE
General Check archive.org Show headers Download Go to Show image Full URL https://safelog.su/images/login/NAB_Defence.gif Requested by Host: safelog.su URL: https://safelog.su/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 93.157.63.156 , Russian Federation, ASN43350 (NFORCE, NL), Reverse DNS hr.thegpauk.com Software Apache / Resource Hash `c4d9a3125d8ae44072e64b39bacde45a74d6157c5d8b7e965b9a919739338e84` Request headers Referer https://safelog.su/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 06 Aug 2020 13:17:49 GMT Last-Modified Thu, 22 Mar 2018 01:39:54 GMT Server Apache Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=79 Content-Length 2741
GET		s1dTqVFazgPNNQC.css ib.nab.com.au/	0 0

GET H/1.1	200 OK	bg_arrow_black.gif safelog.su/images/login/	100 B 341 B	17ms 16ms	Image image/gif	93.157.63.156 NFORCE
General Check archive.org Show headers Download Go to Show image Full URL https://safelog.su/images/login/bg_arrow_black.gif Requested by Host: safelog.su URL: https://safelog.su/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 93.157.63.156 , Russian Federation, ASN43350 (NFORCE, NL), Reverse DNS hr.thegpauk.com Software Apache / Resource Hash `4f48fca9a73368362a7356a8d3fdcc86b40a174b7b83c80b059a9322d0619e47` Request headers Referer https://safelog.su/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 06 Aug 2020 13:17:49 GMT Last-Modified Thu, 22 Mar 2018 01:39:54 GMT Server Apache Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=79 Content-Length 100
GET H/1.1	200 OK	gr_arrow-1.png safelog.su/images/login/	154 B 395 B	17ms 16ms	Image image/png	93.157.63.156 NFORCE
General Check archive.org Show headers Download Go to Show image Full URL https://safelog.su/images/login/gr_arrow-1.png Requested by Host: safelog.su URL: https://safelog.su/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 93.157.63.156 , Russian Federation, ASN43350 (NFORCE, NL), Reverse DNS hr.thegpauk.com Software Apache / Resource Hash `c7a299c1e3976b682508aeac5138f2f31b289d350e94bbd3ccc4f7570b67dcd0` Request headers Referer https://safelog.su/styles/login/_ibRedesign-styles011a.css?id=60 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 06 Aug 2020 13:17:49 GMT Last-Modified Thu, 22 Mar 2018 01:39:54 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=76 Content-Length 154
GET H/1.1	200 OK	bg_banner-2.jpg safelog.su/images/login/	19 KB 19 KB	17ms 16ms	Image image/jpeg	93.157.63.156 NFORCE
General Check archive.org Show headers Download Go to Show image Full URL https://safelog.su/images/login/bg_banner-2.jpg Requested by Host: safelog.su URL: https://safelog.su/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 93.157.63.156 , Russian Federation, ASN43350 (NFORCE, NL), Reverse DNS hr.thegpauk.com Software Apache / Resource Hash `04ff4054aedfdc46f0358f8f145717259c3d264f78837b8eb3bdb46024315947` Request headers Referer https://safelog.su/styles/login/_ibRedesign-styles011a.css?id=60 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 06 Aug 2020 13:17:49 GMT Last-Modified Thu, 22 Mar 2018 01:39:54 GMT Server Apache Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=79 Content-Length 18984
GET H/1.1	200 OK	corpid-b-webfont.woff safelog.su/webfonts/	25 KB 25 KB	17ms 16ms	Font font/woff	93.157.63.156 NFORCE
General Check archive.org Show headers Download Go to Full URL https://safelog.su/webfonts/corpid-b-webfont.woff Requested by Host: safelog.su URL: https://safelog.su/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 93.157.63.156 , Russian Federation, ASN43350 (NFORCE, NL), Reverse DNS hr.thegpauk.com Software Apache / Resource Hash `38db52c7406151339645f1d9e6642be7e31f97457fad34b541bcee77e58d54ac` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://safelog.su/styles/login/_template-styles011a.css?id=60 Origin https://safelog.su Response headers Date Thu, 06 Aug 2020 13:17:49 GMT Last-Modified Thu, 22 Mar 2018 01:39:58 GMT Server Apache Content-Type font/woff Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=79 Content-Length 25440
GET H/1.1	200 OK	corpid-l-webfont.woff safelog.su/webfonts/	27 KB 27 KB	17ms 16ms	Font font/woff	93.157.63.156 NFORCE
General Check archive.org Show headers Download Go to Full URL https://safelog.su/webfonts/corpid-l-webfont.woff Requested by Host: safelog.su URL: https://safelog.su/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 93.157.63.156 , Russian Federation, ASN43350 (NFORCE, NL), Reverse DNS hr.thegpauk.com Software Apache / Resource Hash `680ebc1aecd70eb8791e9fca7d92e873fc94f820c3c22fd38441da7a266db279` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://safelog.su/styles/login/_template-styles011a.css?id=60 Origin https://safelog.su Response headers Date Thu, 06 Aug 2020 13:17:49 GMT Last-Modified Thu, 22 Mar 2018 01:39:58 GMT Server Apache Content-Type font/woff Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=78 Content-Length 27840
GET H/1.1	200 OK	bg_input_user.gif safelog.su/images/login/	257 B 498 B	16ms 16ms	Image image/gif	93.157.63.156 NFORCE
General Check archive.org Show headers Download Go to Show image Full URL https://safelog.su/images/login/bg_input_user.gif Requested by Host: safelog.su URL: https://safelog.su/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 93.157.63.156 , Russian Federation, ASN43350 (NFORCE, NL), Reverse DNS hr.thegpauk.com Software Apache / Resource Hash `4c27e00efc3a284d6406cbe4838292288fd65fb135cb303902e682e7a7a5f473` Request headers Referer https://safelog.su/styles/login/_ibRedesign-styles011a.css?id=60 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 06 Aug 2020 13:17:49 GMT Last-Modified Thu, 22 Mar 2018 01:39:54 GMT Server Apache Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=78 Content-Length 257
GET H/1.1	200 OK	gr_dot-1.gif safelog.su/images/login/	68 B 308 B	16ms 16ms	Image image/gif	93.157.63.156 NFORCE
General Check archive.org Show headers Download Go to Show image Full URL https://safelog.su/images/login/gr_dot-1.gif Requested by Host: safelog.su URL: https://safelog.su/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 93.157.63.156 , Russian Federation, ASN43350 (NFORCE, NL), Reverse DNS hr.thegpauk.com Software Apache / Resource Hash `aded0530b852996f0f6d0bdee146023d096aa2c7990805c8f1f90456172b7892` Request headers Referer https://safelog.su/styles/login/_template-styles011a.css?id=60 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 06 Aug 2020 13:17:49 GMT Last-Modified Thu, 22 Mar 2018 01:39:54 GMT Server Apache Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=78 Content-Length 68
GET H/1.1	200 OK	footer-icon-facebook.gif safelog.su/images/	581 B 822 B	17ms 16ms	Image image/gif	93.157.63.156 NFORCE
General Check archive.org Show headers Download Go to Show image Full URL https://safelog.su/images/footer-icon-facebook.gif Requested by Host: safelog.su URL: https://safelog.su/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 93.157.63.156 , Russian Federation, ASN43350 (NFORCE, NL), Reverse DNS hr.thegpauk.com Software Apache / Resource Hash `b59dac6fad9c97244268d80748845bb6efac3bac4999809675e742e21c0cfac4` Request headers Referer https://safelog.su/styles/login/_ibRedesign-styles011a.css?id=60 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 06 Aug 2020 13:17:49 GMT Last-Modified Thu, 22 Mar 2018 01:39:54 GMT Server Apache Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=75 Content-Length 581
GET H/1.1	200 OK	footer-icon-twitter.gif safelog.su/images/	449 B 690 B	16ms 16ms	Image image/gif	93.157.63.156 NFORCE
General Check archive.org Show headers Download Go to Show image Full URL https://safelog.su/images/footer-icon-twitter.gif Requested by Host: safelog.su URL: https://safelog.su/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 93.157.63.156 , Russian Federation, ASN43350 (NFORCE, NL), Reverse DNS hr.thegpauk.com Software Apache / Resource Hash `740b92b37caf1906cd34828753b3c60f3f92fa7d89c172a757ae8ddb229c413b` Request headers Referer https://safelog.su/styles/login/_ibRedesign-styles011a.css?id=60 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 06 Aug 2020 13:17:49 GMT Last-Modified Thu, 22 Mar 2018 01:39:54 GMT Server Apache Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=77 Content-Length 449
GET H/1.1	200 OK	footer-icon-gplus.gif safelog.su/images/	1 KB 1 KB	17ms 16ms	Image image/gif	93.157.63.156 NFORCE
General Check archive.org Show headers Download Go to Show image Full URL https://safelog.su/images/footer-icon-gplus.gif Requested by Host: safelog.su URL: https://safelog.su/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 93.157.63.156 , Russian Federation, ASN43350 (NFORCE, NL), Reverse DNS hr.thegpauk.com Software Apache / Resource Hash `345e5797bde0b78107d25a3ab912482a2009a90dcc37c61e10f04bdf90a5c9e6` Request headers Referer https://safelog.su/styles/login/_ibRedesign-styles011a.css?id=60 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 06 Aug 2020 13:17:49 GMT Last-Modified Thu, 22 Mar 2018 01:39:54 GMT Server Apache Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=77 Content-Length 1046
GET H/1.1	200 OK	footer-icon-youtube.gif safelog.su/images/	1 KB 1 KB	16ms 16ms	Image image/gif	93.157.63.156 NFORCE
General Check archive.org Show headers Download Go to Show image Full URL https://safelog.su/images/footer-icon-youtube.gif Requested by Host: safelog.su URL: https://safelog.su/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 93.157.63.156 , Russian Federation, ASN43350 (NFORCE, NL), Reverse DNS hr.thegpauk.com Software Apache / Resource Hash `4b0f8a88bea8e8300faf9c6eb50d989aed7b008262dd482f78ed3e340251adc5` Request headers Referer https://safelog.su/styles/login/_ibRedesign-styles011a.css?id=60 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 06 Aug 2020 13:17:49 GMT Last-Modified Thu, 22 Mar 2018 01:39:54 GMT Server Apache Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=77 Content-Length 1200

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: ib.nab.com.au
URL: http://ib.nab.com.au/s1dTqVFazgPNNQC.css

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: NAB Bank (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ib.nab.com.au
safelog.su
ib.nab.com.au
93.157.63.156
04ff4054aedfdc46f0358f8f145717259c3d264f78837b8eb3bdb46024315947
10b169f2b5d4b731c3197b3e3a58d673b5fe9c1dfb4c582bbf46cc8a1a9789a9
1cf5bc7b9465431a5ece0ba6438290ebc48a5b5c82e89bf91ba9ca216bc2f75c
1e61ffdfeb77f256dee30dd9b345b360df85c67bace0dc5092ee0afdc44d3e05
209b7c6180f8e2023e895d29c6608625c478938409983d775d1de51145ef039c
345e5797bde0b78107d25a3ab912482a2009a90dcc37c61e10f04bdf90a5c9e6
38db52c7406151339645f1d9e6642be7e31f97457fad34b541bcee77e58d54ac
39a929b4980dd0d19c4ab88cd9ffaa8b475e8917716e58ea9a850f035b1f89da
42cd7e6840328e01120e434b12d6c669c973c96d0b16aafc82f0116481dd6429
4b0f8a88bea8e8300faf9c6eb50d989aed7b008262dd482f78ed3e340251adc5
4c27e00efc3a284d6406cbe4838292288fd65fb135cb303902e682e7a7a5f473
4f48fca9a73368362a7356a8d3fdcc86b40a174b7b83c80b059a9322d0619e47
680ebc1aecd70eb8791e9fca7d92e873fc94f820c3c22fd38441da7a266db279
6850f450a8c2ec0d3b2c1531f1283320f5dfff954341865498f66001b81c8501
740b92b37caf1906cd34828753b3c60f3f92fa7d89c172a757ae8ddb229c413b
aded0530b852996f0f6d0bdee146023d096aa2c7990805c8f1f90456172b7892
b59dac6fad9c97244268d80748845bb6efac3bac4999809675e742e21c0cfac4
c4d9a3125d8ae44072e64b39bacde45a74d6157c5d8b7e965b9a919739338e84
c71d7e5acf144495ab47a04c96477bc19c80fc80d39a434d0b99ac61771dfdfd
c7a299c1e3976b682508aeac5138f2f31b289d350e94bbd3ccc4f7570b67dcd0
c8b5c36b604b175f0c6be6b98f40c5b82c05b0a76aadd383a61b0f4fe0b3d264

safelog.su Open in urlscan Pro 93.157.63.156 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

23 Requests

96 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

144 kBTransfer

139 kBSize

0 Cookies

1 Outgoing links

Redirected requests

23 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

safelog.su Open in urlscan Pro
93.157.63.156 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

23
Requests

96 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

144 kB
Transfer

139 kB
Size

0
Cookies

23 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!