secure-payee-removal05.com Open in urlscan Pro
185.156.72.17  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request loading.php Show response secure-payee-removal05.com/	25 KB 6 KB	730ms 237ms	Document text/html	185.156.72.17 VAIZ-AS ITBks892
General Check archive.org Show headers Download Go to Full URL http://secure-payee-removal05.com/loading.php Protocol HTTP/1.1 Server 185.156.72.17 , Russian Federation, ASN61432 (VAIZ-AS ITBks892, UA), Reverse DNS Software LiteSpeed / Resource Hash 5e831e894d2344740008f0f5371ce0f837554ea42d5f7724706889b0bb725829 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers Connection Keep-Alive Keep-Alive timeout=5, max=100 cache-control no-store, no-cache, must-revalidate content-encoding gzip content-length 6078 content-type text/html; charset=UTF-8 date Mon, 01 May 2023 04:02:58 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server LiteSpeed vary Accept-Encoding
GET H2	200	polyfill.wp.js Show response bank.barclays.co.uk//authlogin/lib/	98 KB 98 KB	523ms 476ms	Script application/x-javascript	184.26.254.23 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://bank.barclays.co.uk//authlogin/lib/polyfill.wp.js Requested by Host: secure-payee-removal05.com URL: http://secure-payee-removal05.com/loading.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.26.254.23 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a184-26-254-23.deploy.static.akamaitechnologies.com Software / Resource Hash 02e9e14e36ad05a2a528e81898868b7c9fb738980d111599f4460dc7926aa1b0 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload Request headers accept-language jp-JP,jp;q=0.9 Referer http://secure-payee-removal05.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers strict-transport-security max-age=63072000; includeSubDomains; preload date Mon, 01 May 2023 04:02:59 GMT last-modified Thu, 11 Feb 2021 14:44:55 GMT etag "18659-602542e7" content-type application/x-javascript accept-ranges bytes content-length 99929 x-ua-compatible chrome=IE6
GET H2	200	angular.min.js Show response bank.barclays.co.uk//js/myBarclays/vendor/angular/	105 KB 39 KB	529ms 483ms	Script application/x-javascript	184.26.254.23 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://bank.barclays.co.uk//js/myBarclays/vendor/angular/angular.min.js Requested by Host: secure-payee-removal05.com URL: http://secure-payee-removal05.com/loading.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.26.254.23 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a184-26-254-23.deploy.static.akamaitechnologies.com Software / Resource Hash f8ea0e980b8bdca260f9f81d0e98360c3080fdc7fd3992cf611e05701e2e8a36 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language jp-JP,jp;q=0.9 Referer http://secure-payee-removal05.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers strict-transport-security max-age=63072000; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Mon, 01 May 2023 04:02:59 GMT last-modified Tue, 14 Mar 2023 09:34:09 GMT etag "9bd6-64103f91" vary accept-encoding content-type application/x-javascript accept-ranges bytes content-length 39894 x-ua-compatible chrome=IE6
GET H2	200	angular-route.min.js Show response bank.barclays.co.uk//js/myBarclays/vendor/angular/	4 KB 2 KB	551ms 505ms	Script application/x-javascript	184.26.254.23 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://bank.barclays.co.uk//js/myBarclays/vendor/angular/angular-route.min.js Requested by Host: secure-payee-removal05.com URL: http://secure-payee-removal05.com/loading.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.26.254.23 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a184-26-254-23.deploy.static.akamaitechnologies.com Software / Resource Hash 225667650d0be401e4cb148aa2dea5ad695c19563d2f94cfa20aa7082c5c966a Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language jp-JP,jp;q=0.9 Referer http://secure-payee-removal05.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers strict-transport-security max-age=63072000; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Mon, 01 May 2023 04:02:59 GMT last-modified Tue, 14 Mar 2023 09:34:08 GMT etag "75b-64103f90" vary accept-encoding content-type application/x-javascript accept-ranges bytes content-length 1883 x-ua-compatible chrome=IE6
GET H2	200	angular-cookies.min.js Show response bank.barclays.co.uk//js/myBarclays/vendor/angular/	833 B 836 B	527ms 482ms	Script application/x-javascript	184.26.254.23 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://bank.barclays.co.uk//js/myBarclays/vendor/angular/angular-cookies.min.js Requested by Host: secure-payee-removal05.com URL: http://secure-payee-removal05.com/loading.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.26.254.23 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a184-26-254-23.deploy.static.akamaitechnologies.com Software / Resource Hash 3d189cf625d46ea41cff74ba7c2729c548f9a443552ac8c5888f2b8b0dc75c60 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language jp-JP,jp;q=0.9 Referer http://secure-payee-removal05.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers strict-transport-security max-age=63072000; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Mon, 01 May 2023 04:02:59 GMT last-modified Tue, 14 Mar 2023 09:34:08 GMT etag "206-64103f90" vary accept-encoding content-type application/x-javascript accept-ranges bytes content-length 518 x-ua-compatible chrome=IE6
GET H2	200	angular-sanitize.min.js Show response bank.barclays.co.uk//js/myBarclays/vendor/angular/	4 KB 3 KB	558ms 513ms	Script application/x-javascript	184.26.254.23 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://bank.barclays.co.uk//js/myBarclays/vendor/angular/angular-sanitize.min.js Requested by Host: secure-payee-removal05.com URL: http://secure-payee-removal05.com/loading.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.26.254.23 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a184-26-254-23.deploy.static.akamaitechnologies.com Software / Resource Hash 20318e023853ac4d3e1f231b0532de4c39d83c629a4155756c021e57825dc884 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language jp-JP,jp;q=0.9 Referer http://secure-payee-removal05.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers strict-transport-security max-age=63072000; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Mon, 01 May 2023 04:02:59 GMT last-modified Tue, 14 Mar 2023 09:34:09 GMT etag "96c-64103f91" vary accept-encoding content-type application/x-javascript accept-ranges bytes content-length 2412 x-ua-compatible chrome=IE6
GET H2	200	bdlLogin-rolb-dss.min.js Show response bank.barclays.co.uk//authlogin/	256 KB 67 KB	565ms 520ms	Script application/x-javascript	184.26.254.23 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://bank.barclays.co.uk//authlogin/bdlLogin-rolb-dss.min.js?v=1606745934868 Requested by Host: secure-payee-removal05.com URL: http://secure-payee-removal05.com/loading.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.26.254.23 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a184-26-254-23.deploy.static.akamaitechnologies.com Software / Resource Hash 9ade0326f7dc6af27f034b989c0e250569608abfd9ee01ce7210ea65a02ce836 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language jp-JP,jp;q=0.9 Referer http://secure-payee-removal05.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers strict-transport-security max-age=63072000; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Mon, 01 May 2023 04:02:59 GMT last-modified Tue, 21 Mar 2023 08:11:28 GMT etag "107ee-641966b0" vary accept-encoding content-type application/x-javascript accept-ranges bytes content-length 67566 x-ua-compatible chrome=IE6
GET H2	200	bdlLogin-libraries.min.js Show response bank.barclays.co.uk//authlogin/	71 KB 27 KB	526ms 481ms	Script application/x-javascript	184.26.254.23 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://bank.barclays.co.uk//authlogin/bdlLogin-libraries.min.js?v=1606745934868 Requested by Host: secure-payee-removal05.com URL: http://secure-payee-removal05.com/loading.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.26.254.23 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a184-26-254-23.deploy.static.akamaitechnologies.com Software / Resource Hash 23258114961c94563c3e7df66f059d487995e01f4ce666f2e5b84f1c499e63cc Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language jp-JP,jp;q=0.9 Referer http://secure-payee-removal05.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers strict-transport-security max-age=63072000; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Mon, 01 May 2023 04:02:59 GMT last-modified Tue, 21 Mar 2023 08:11:28 GMT etag "6a7a-641966b0" vary accept-encoding content-type application/x-javascript accept-ranges bytes content-length 27258 x-ua-compatible chrome=IE6
GET H2	200	bdlLogin-rolb-app.min.js Show response bank.barclays.co.uk//authlogin/	301 KB 82 KB	549ms 504ms	Script application/x-javascript	184.26.254.23 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://bank.barclays.co.uk//authlogin/bdlLogin-rolb-app.min.js?v=1606745934868 Requested by Host: secure-payee-removal05.com URL: http://secure-payee-removal05.com/loading.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.26.254.23 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a184-26-254-23.deploy.static.akamaitechnologies.com Software / Resource Hash 884e86e90bf313a2e674e32f9922a7b3f6aaea20af0445c8fcd87ffb4abd3d67 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language jp-JP,jp;q=0.9 Referer http://secure-payee-removal05.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers strict-transport-security max-age=63072000; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Mon, 01 May 2023 04:02:59 GMT last-modified Tue, 21 Mar 2023 08:11:28 GMT etag "14706-641966b0" vary accept-encoding content-type application/x-javascript accept-ranges bytes content-length 83718 x-ua-compatible chrome=IE6
GET H2	200	jquery-3.5.1.js Show response code.jquery.com/	281 KB 83 KB	348ms 110ms	Script application/javascript	2001:4de0:ac18::1:a:3a STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.5.1.js Requested by Host: secure-payee-removal05.com URL: http://secure-payee-removal05.com/loading.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:3a , Netherlands, ASN20446 (STACKPATH-CDN, US), Reverse DNS Software nginx / Resource Hash 416a3b2c3bf16d64f6b5b6d0f7b079df2267614dd6847fc2f3271b4409233c37 Request headers Referer http://secure-payee-removal05.com/ Origin http://secure-payee-removal05.com accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers date Mon, 01 May 2023 04:02:59 GMT content-encoding gzip last-modified Fri, 20 Aug 2021 17:47:53 GMT server nginx etag W/"611feac9-4638e" vary Accept-Encoding x-hw 1682913779.dop028.sj3.t,1682913779.cds209.sj3.hn,1682913779.cds204.sj3.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 84374
GET H2	200	rolb-theme-2-0.css bank.barclays.co.uk//authlogin/css/	333 KB 69 KB	565ms 520ms	Stylesheet text/css	184.26.254.23 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://bank.barclays.co.uk//authlogin/css/rolb-theme-2-0.css?v=1606745934868 Requested by Host: secure-payee-removal05.com URL: http://secure-payee-removal05.com/loading.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.26.254.23 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a184-26-254-23.deploy.static.akamaitechnologies.com Software / Resource Hash 32f5891b648500c4f534390e1c348060685ba728e64394d964e778eedabd7249 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language jp-JP,jp;q=0.9 Referer http://secure-payee-removal05.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers strict-transport-security max-age=63072000; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Mon, 01 May 2023 04:02:59 GMT last-modified Tue, 21 Mar 2023 08:11:28 GMT etag "11083-641966b0" vary accept-encoding content-type text/css accept-ranges bytes content-length 69763 x-ua-compatible chrome=IE6
GET H2	200	authlogin-bdl.min.css bank.barclays.co.uk//authlogin/css/	45 KB 45 KB	567ms 523ms	Stylesheet text/css	184.26.254.23 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://bank.barclays.co.uk//authlogin/css/authlogin-bdl.min.css?v=1606745934868 Requested by Host: secure-payee-removal05.com URL: http://secure-payee-removal05.com/loading.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.26.254.23 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a184-26-254-23.deploy.static.akamaitechnologies.com Software / Resource Hash c7588e66ab3dfc34b4beda8e07aa630e5a764a001d7568244ef963c3620f3365 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language jp-JP,jp;q=0.9 Referer http://secure-payee-removal05.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers strict-transport-security max-age=63072000; includeSubDomains; preload date Mon, 01 May 2023 04:02:59 GMT x-content-type-options nosniff last-modified Thu, 11 Feb 2021 14:45:04 GMT etag "b345-602542f0" content-type text/css accept-ranges bytes content-length 45893 x-ua-compatible chrome=IE6
GET H/1.1	404 Not Found	1321077850566-sortcode_account_number_card.jpg secure-payee-removal05.com/OLB/A/Content/Images/	1 KB 1 KB	237ms 237ms	Image text/html	185.156.72.17 VAIZ-AS ITBks892
General Check archive.org Show headers Download Go to Show image Full URL http://secure-payee-removal05.com/OLB/A/Content/Images/1321077850566-sortcode_account_number_card.jpg Requested by Host: secure-payee-removal05.com URL: http://secure-payee-removal05.com/loading.php Protocol HTTP/1.1 Server 185.156.72.17 , Russian Federation, ASN61432 (VAIZ-AS ITBks892, UA), Reverse DNS Software LiteSpeed / Resource Hash 5dc1ae0b875dc0d78dbc5532226f5f31b762b4d1229984f605d27bf895ab6807 Request headers accept-language jp-JP,jp;q=0.9 Referer http://secure-payee-removal05.com/loading.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers pragma no-cache date Mon, 01 May 2023 04:02:59 GMT server LiteSpeed content-type text/html cache-control private, no-cache, no-store, must-revalidate, max-age=0 Connection Keep-Alive Keep-Alive timeout=5, max=100 content-length 1238
GET DATA	200 OK	truncated /	2 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 91a06213190743f440aa3411f1393afaf3de8b3b6309d6677fb7680248f09e91 Request headers accept-language jp-JP,jp;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers Content-Type image/svg+xml;charset=US-ASCII
GET DATA	200 OK	truncated /	2 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash e111be4c24fc0743ca7eb1c4873a64bb234135b9bea86cabd922a5caabb6c9c6 Request headers accept-language jp-JP,jp;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers Content-Type image/svg+xml;charset=US-ASCII
GET H2	200	Padlock_icon.svg bank.barclays.co.uk//authlogin/img/	2 KB 1 KB	245ms 245ms	Image image/svg+xml	184.26.254.23 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://bank.barclays.co.uk//authlogin/img/Padlock_icon.svg Requested by Host: bank.barclays.co.uk URL: https://bank.barclays.co.uk//authlogin/css/authlogin-bdl.min.css?v=1606745934868 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.26.254.23 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a184-26-254-23.deploy.static.akamaitechnologies.com Software / Resource Hash b173ff6e97748a8a4e079bf7afa965e4d264fa43a351c4a0bf2c130bc65b4366 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language jp-JP,jp;q=0.9 Referer https://bank.barclays.co.uk//authlogin/css/authlogin-bdl.min.css?v=1606745934868 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers strict-transport-security max-age=63072000; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Mon, 01 May 2023 04:03:00 GMT last-modified Tue, 21 Mar 2023 08:11:28 GMT etag "2f3-641966b0" vary accept-encoding content-type image/svg+xml accept-ranges bytes content-length 755 x-ua-compatible chrome=IE6
GET		expert-sans-regular.woff bank.barclays.co.uk//authlogin/css/fonts/	0 0
GET H/1.1	404 Not Found	activity.php Show response secure-payee-removal05.com/files/	1 KB 1 KB	237ms 237ms	XHR text/html	185.156.72.17 VAIZ-AS ITBks892
General Check archive.org Show headers Download Go to Full URL http://secure-payee-removal05.com/files/activity.php Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.5.1.js Protocol HTTP/1.1 Server 185.156.72.17 , Russian Federation, ASN61432 (VAIZ-AS ITBks892, UA), Reverse DNS Software LiteSpeed / Resource Hash 5dc1ae0b875dc0d78dbc5532226f5f31b762b4d1229984f605d27bf895ab6807 Request headers Accept */* Referer http://secure-payee-removal05.com/loading.php X-Requested-With XMLHttpRequest accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers pragma no-cache date Mon, 01 May 2023 04:03:03 GMT server LiteSpeed content-type text/html cache-control private, no-cache, no-store, must-revalidate, max-age=0 Connection Keep-Alive Keep-Alive timeout=5, max=100 content-length 1238
GET H/1.1	404 Not Found	activity.php Show response secure-payee-removal05.com/files/	1 KB 1 KB	236ms 236ms	XHR text/html	185.156.72.17 VAIZ-AS ITBks892
General Check archive.org Show headers Download Go to Full URL http://secure-payee-removal05.com/files/activity.php Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.5.1.js Protocol HTTP/1.1 Server 185.156.72.17 , Russian Federation, ASN61432 (VAIZ-AS ITBks892, UA), Reverse DNS Software LiteSpeed / Resource Hash 5dc1ae0b875dc0d78dbc5532226f5f31b762b4d1229984f605d27bf895ab6807 Request headers Accept */* Referer http://secure-payee-removal05.com/loading.php X-Requested-With XMLHttpRequest accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers pragma no-cache date Mon, 01 May 2023 04:03:06 GMT server LiteSpeed content-type text/html cache-control private, no-cache, no-store, must-revalidate, max-age=0 Connection Keep-Alive Keep-Alive timeout=5, max=100 content-length 1238

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

bank.barclays.co.uk

URL

https://bank.barclays.co.uk//authlogin/css/fonts/expert-sans-regular.woff

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Barclays (Banking)

86 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 boolean| credentialless object| __core-js_shared__ object| core object| global object| System function| asap function| Observable function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill object| angular number| ng339 function| _ function| getElementsByClassName function| getTextContent function| scFixed function| scFixed1Tag function| scAppendWholeTag function| scLowRankTag function| scProductsTag function| scSetLinkNameTag function| scCombinedP123 function| scRemap function| tagPageView function| tagAjaxContent function| tagQueryContents function| setFromClickTagsFTB function| scLinkTrack function| scLinkTrackError function| dcsMultiTrack function| scMeta function| scSetInitial function| scSetDerived function| isLoginPage function| isHomePage function| scSetHelpCardButtons function| scCleanUpEvents function| scLoginPagesTracking function| scCleanUp function| scSetValidationErrorMessage function| fireLoadEvent function| scSetErrorMessage function| scSetErrorServiceMessage function| scSetImpressions function| scSetLOGIN_METHOD function| scSetLOGIN_MECHANISM function| scSetLoginEvents function| scSetDeepLink function| scSetdcsuri function| scSetProducts function| scSetView function| getProp34 function| scSetPurchaseTracking function| scSetActivityTracking function| scSetLoginReg function| scSetPageName function| isMultipleSavedUsers function| scSetEvents function| scSetDcsvid function| scBarclaysCookieConsent function| scMapTag function| scSetTag function| scAddTag function| scUpdateLinkTrack function| scSaveBasePageName function| scRestoreBasePageName function| scSaveTakeoverPageName function| scRestoreTakeoverPageName object| AppName object| authloginDigitalData string| s_account object| dcs2sc string| scBasePageName string| scTakeoverPageName object| _self object| Prism string| digitalDataDeviceBuildId undefined| WebAnalytics function| $ function| jQuery boolean| ie8 object| dataLayer number| interval function| heartbeat

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			secure-payee-removal05.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 0ddba74275430d6ead8d34772c94bcd2

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://secure-payee-removal05.com/OLB/A/Content/Images/1321077850566-sortcode_account_number_card.jpg Message: Failed to load resource: the server responded with a status of 404 (Not Found)
javascript	error	URL: http://secure-payee-removal05.com/loading.php Message: Access to font at 'https://bank.barclays.co.uk//authlogin/css/fonts/expert-sans-regular.woff' from origin 'http://secure-payee-removal05.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://bank.barclays.co.uk//authlogin/css/fonts/expert-sans-regular.woff Message: Failed to load resource: net::ERR_FAILED
network	error	URL: http://secure-payee-removal05.com/files/activity.php Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: http://secure-payee-removal05.com/files/activity.php Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bank.barclays.co.uk
code.jquery.com
secure-payee-removal05.com
bank.barclays.co.uk
184.26.254.23
185.156.72.17
2001:4de0:ac18::1:a:3a
02e9e14e36ad05a2a528e81898868b7c9fb738980d111599f4460dc7926aa1b0
20318e023853ac4d3e1f231b0532de4c39d83c629a4155756c021e57825dc884
225667650d0be401e4cb148aa2dea5ad695c19563d2f94cfa20aa7082c5c966a
23258114961c94563c3e7df66f059d487995e01f4ce666f2e5b84f1c499e63cc
32f5891b648500c4f534390e1c348060685ba728e64394d964e778eedabd7249
3d189cf625d46ea41cff74ba7c2729c548f9a443552ac8c5888f2b8b0dc75c60
416a3b2c3bf16d64f6b5b6d0f7b079df2267614dd6847fc2f3271b4409233c37
5dc1ae0b875dc0d78dbc5532226f5f31b762b4d1229984f605d27bf895ab6807
5e831e894d2344740008f0f5371ce0f837554ea42d5f7724706889b0bb725829
884e86e90bf313a2e674e32f9922a7b3f6aaea20af0445c8fcd87ffb4abd3d67
91a06213190743f440aa3411f1393afaf3de8b3b6309d6677fb7680248f09e91
9ade0326f7dc6af27f034b989c0e250569608abfd9ee01ce7210ea65a02ce836
b173ff6e97748a8a4e079bf7afa965e4d264fa43a351c4a0bf2c130bc65b4366
c7588e66ab3dfc34b4beda8e07aa630e5a764a001d7568244ef963c3620f3365
e111be4c24fc0743ca7eb1c4873a64bb234135b9bea86cabd922a5caabb6c9c6
f8ea0e980b8bdca260f9f81d0e98360c3080fdc7fd3992cf611e05701e2e8a36