n-a-b-verify.web.app Open in urlscan Pro
2620:0:890::100 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://n-a-b-verify.web.app/
Submission Tags: 7577613
Submission: On July 03 via api (July 3rd 2022, 11:27:27 pm UTC) from DE — Scanned from DE

Summary HTTP 18 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 18 HTTP transactions. The main IP is 2620:0:890::100, located in United States and belongs to FASTLY, US. The main domain is n-a-b-verify.web.app.
TLS certificate: Issued by GTS CA 1D4 on June 13th 2022. Valid for: 3 months.

This is the only time n-a-b-verify.web.app was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: NAB Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
8	2620:0:890::100 2620:0:890::100	54113 (FASTLY) (FASTLY)
1	96.16.133.121 96.16.133.121	16625 (AKAMAI-AS) (AKAMAI-AS)
18	3

8 2620:0:890::100 (United States)

ASN54113 (FASTLY, US)

n-a-b-verify.web.app	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 96.16.133.121 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a96-16-133-121.deploy.static.akamaitechnologies.com

ib.nab.com.au	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	web.app n-a-b-verify.web.app	450 KB
1	nab.com.au ib.nab.com.au — Cisco Umbrella Rank: 900844 Failed	587 B
18	2

	Domain	Requested by
8	n-a-b-verify.web.app	n-a-b-verify.web.app
1	ib.nab.com.au	n-a-b-verify.web.app
18	2

This site contains no links.

Subject Issuer	Validity	Valid
web.app GTS CA 1D4	`2022-06-13` - `2022-09-11`	3 months	crt.sh
ib.nab.com.au Entrust Certification Authority - L1M	`2021-10-18` - `2022-10-19`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://n-a-b-verify.web.app/
Frame ID: E2280CFE746560E57083C054C872CF1F
Requests: 29 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

nab

Detected technologies

Nuxt.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

/_nuxt/

Page Statistics

18
Requests

50 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

640 kB
Transfer

2518 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions
11 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
n-a-b-verify.web.app/ 3 KB
1 KB 109ms
54ms Document
text/html 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://n-a-b-verify.web.app/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

6c784295f1e7b25d6c26f198e37fb9abf7ff9504dbdcaf626369ea4377da16d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
cache-control: max-age=3600
content-encoding: br
content-length: 801
content-type: text/html; charset=utf-8
date: Sun, 03 Jul 2022 23:27:20 GMT
etag: "068cf034b9aa53dc825efd68b1f2f44d633f67609189ecc6b052f6c5d1238458-br"
last-modified: Sun, 03 Jul 2022 22:21:36 GMT
strict-transport-security: max-age=31556926; includeSubDomains; preload
vary: x-fh-requested-host, accept-encoding
x-cache: MISS
x-cache-hits: 0
x-served-by: cache-mxp6927-MXP
x-timer: S1656890840.321615,VS0,VE38

GET
H2 200 6.0e9a4b25fdae3f52a5d79.955043348256043.js Show response
n-a-b-verify.web.app/_nuxt/ 2 KB
1 KB 56ms
55ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://n-a-b-verify.web.app/_nuxt/6.0e9a4b25fdae3f52a5d79.955043348256043.js

Requested by

Host: n-a-b-verify.web.app
URL: https://n-a-b-verify.web.app/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

2cbc9c35d726f0896fd41ef7cbbb7dc2e12df23337e2697435df13a30dba42e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://n-a-b-verify.web.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
last-modified: Sun, 03 Jul 2022 22:21:36 GMT
x-timer: S1656890840.380095,VS0,VE40
etag: "49c9ad28bbca63e11c4bae356100c805587226d164902cdac28e245b7c8f414b-br"
x-served-by: cache-mxp6927-MXP
vary: x-fh-requested-host, accept-encoding
x-cache: MISS
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
date: Sun, 03 Jul 2022 23:27:20 GMT
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 1096
x-cache-hits: 0

GET
H2 200 1.d79874da2c5f1f664d940.9024745076986873.js Show response
n-a-b-verify.web.app/_nuxt/ 192 KB
58 KB 66ms
65ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://n-a-b-verify.web.app/_nuxt/1.d79874da2c5f1f664d940.9024745076986873.js

Requested by

Host: n-a-b-verify.web.app
URL: https://n-a-b-verify.web.app/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

1b38b540271daccc06d9b51ab31651bbdd940453e1b1de6555dfe9cad50eff11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://n-a-b-verify.web.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
last-modified: Sun, 03 Jul 2022 22:21:36 GMT
x-timer: S1656890840.380246,VS0,VE49
etag: "1ed66071b351626f8afcec5a525677aa5f1a454f8da1dbb71c8b2f3da6a127f8-br"
x-served-by: cache-mxp6927-MXP
vary: x-fh-requested-host, accept-encoding
x-cache: MISS
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
date: Sun, 03 Jul 2022 23:27:20 GMT
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 59498
x-cache-hits: 0

GET
H2 200 7.f473d4df31023424cfc50.9024745076986873.js Show response
n-a-b-verify.web.app/_nuxt/ 56 KB
15 KB 63ms
63ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://n-a-b-verify.web.app/_nuxt/7.f473d4df31023424cfc50.9024745076986873.js

Requested by

Host: n-a-b-verify.web.app
URL: https://n-a-b-verify.web.app/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

0c25fae01f3d533727ed91660c352361177d60becaf1a9918829ba15ddc338e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://n-a-b-verify.web.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
last-modified: Sun, 03 Jul 2022 22:21:36 GMT
x-timer: S1656890840.380370,VS0,VE47
etag: "14e27144d7f37796cea24080cba75fa604404c74b654a8e69d129bea6ee71471-br"
x-served-by: cache-mxp6927-MXP
vary: x-fh-requested-host, accept-encoding
x-cache: MISS
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
date: Sun, 03 Jul 2022 23:27:20 GMT
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 14843
x-cache-hits: 0

GET
H2 200 0.0eafde03a32587da9d1c0.9024745076986873.js Show response
n-a-b-verify.web.app/_nuxt/ 119 B
227 B 54ms
54ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://n-a-b-verify.web.app/_nuxt/0.0eafde03a32587da9d1c0.9024745076986873.js

Requested by

Host: n-a-b-verify.web.app
URL: https://n-a-b-verify.web.app/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

1e5174af3db3b5e05fdc10059d98dc0949864ad66928208c7e1e18e85c2843ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://n-a-b-verify.web.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
last-modified: Sun, 03 Jul 2022 22:21:36 GMT
x-timer: S1656890840.380360,VS0,VE37
etag: "080dbe943395897d86299f8c929e1f57146bd6b8550f70f8fa2b8c6e75394437-br"
x-served-by: cache-mxp6927-MXP
vary: x-fh-requested-host, accept-encoding
x-cache: MISS
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
date: Sun, 03 Jul 2022 23:27:20 GMT
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 91
x-cache-hits: 0

GET
H3 200 2.7dc8036fddc27c2728e70.9024745076986873.js Show response
n-a-b-verify.web.app/_nuxt/ 20 KB
7 KB 55ms
54ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://n-a-b-verify.web.app/_nuxt/2.7dc8036fddc27c2728e70.9024745076986873.js

Requested by

Host: n-a-b-verify.web.app
URL: https://n-a-b-verify.web.app/_nuxt/6.0e9a4b25fdae3f52a5d79.955043348256043.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

9c985a29439b8fe255145d51808c30e01e9505b736a595332fa07f655a42bd0d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://n-a-b-verify.web.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
last-modified: Sun, 03 Jul 2022 22:21:36 GMT
x-timer: S1656890840.495659,VS0,VE38
etag: "39bad113c857f3f4f85f88db5a9ce1e671ce7e4db6cc9c0317c8a9f22212afe1-br"
x-served-by: cache-mxp6963-MXP
vary: x-fh-requested-host, accept-encoding
x-cache: MISS
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
date: Sun, 03 Jul 2022 23:27:20 GMT
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 6334
x-cache-hits: 0

GET
H3 200 8.9b9e5dd97aeab872e1c10.9024745076986873.js Show response
n-a-b-verify.web.app/_nuxt/ 22 KB
6 KB 55ms
55ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://n-a-b-verify.web.app/_nuxt/8.9b9e5dd97aeab872e1c10.9024745076986873.js

Requested by

Host: n-a-b-verify.web.app
URL: https://n-a-b-verify.web.app/_nuxt/6.0e9a4b25fdae3f52a5d79.955043348256043.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

9bb93aa94a3814a975a8d5a43e9fd77d1d494e8a760b5571dc92cc68c8b90942

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://n-a-b-verify.web.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
last-modified: Sun, 03 Jul 2022 22:21:36 GMT
x-timer: S1656890840.495806,VS0,VE38
etag: "a07f5016663eaaeee845128779ed33acea48985d785c1a65f544f51958c18602-br"
x-served-by: cache-mxp6963-MXP
vary: x-fh-requested-host, accept-encoding
x-cache: MISS
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
date: Sun, 03 Jul 2022 23:27:20 GMT
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 6147
x-cache-hits: 0

GET
H3 200 5.238f0cf2a71700575b8b0.9024745076986873.js Show response
n-a-b-verify.web.app/_nuxt/ 2 MB
362 KB 159ms
159ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://n-a-b-verify.web.app/_nuxt/5.238f0cf2a71700575b8b0.9024745076986873.js

Requested by

Host: n-a-b-verify.web.app
URL: https://n-a-b-verify.web.app/_nuxt/6.0e9a4b25fdae3f52a5d79.955043348256043.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

3324a45c2fd599124f79dab9af2ea349742aa4ba438cd99972f9a77cb4f5577c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://n-a-b-verify.web.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
last-modified: Sun, 03 Jul 2022 22:21:36 GMT
x-timer: S1656890840.495917,VS0,VE142
etag: "29fd234c099945fb19123b6648565d6be8bb4a9585d6a97cbb8345de71f04d15-br"
x-served-by: cache-mxp6963-MXP
vary: x-fh-requested-host, accept-encoding
x-cache: MISS
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
date: Sun, 03 Jul 2022 23:27:20 GMT
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 370423
x-cache-hits: 0

GET sourcesanspro-400.58dd2a1c6d7861ea261912ba153ac8e3.woff2
ib.nab.com.au/reno/shell/v4.22.0/assets/ 0
0

GET
DATA 200
OK truncated
/ 14 KB
14 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 599d93e0748728edc6bd55a82a52bff61196b149d566a67d4ed86d55d9c520aa

Request headers

Referer
Origin: https://n-a-b-verify.web.app
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: font/woff2

GET
DATA 200
OK truncated
/ 29 KB
29 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a07b6772c9e702f6f2b7b83e02f76515970eb54aeec4b7b7b00450a3b35594f3

Request headers

Referer
Origin: https://n-a-b-verify.web.app
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: application/font-woff

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ea07872aaed934e600a19b6a02dbe59d12b79b1df101a65d365625646db3b273

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 pixel_18a4ef50
ib.nab.com.au/akam/13/ 0
587 B 337ms
248ms Image
text/html 96.16.133.121
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ib.nab.com.au/akam/13/pixel_18a4ef50?a=dD00ZTE0MWM5YWQzMjFhNWViYzJkZTYxYTkxZjA5ZDZmNzZmZDIzYjdhJmpzPW9mZg==
Requested by: Host: n-a-b-verify.web.app
URL: https://n-a-b-verify.web.app/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 96.16.133.121 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a96-16-133-121.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://n-a-b-verify.web.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Sun, 03 Jul 2022 23:27:21 GMT
content-length: 0
content-type: text/html

GET
DATA 200
OK truncated
/ 185 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e6f1885aa9fc30aacc0f76863c02f30235305c44fb990ca1f02afa8a54dfd453

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 280 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8a896aa0442917bb7d85724bf614b42ab9ff82ad1f6a970733b76f2b11bfee2e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET sourcesanspro-700.c18b7366babf6ace33427f60cf7fa7e0.woff2
ib.nab.com.au/reno/shell/v4.22.0/assets/ 0
0

GET
DATA 200
OK truncated
/ 13 KB
13 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 853f501c07636c1cf0ab27ea73f4e5845b495f950ded2b2fcd603d377a8b547c

Request headers

Referer
Origin: https://n-a-b-verify.web.app
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: font/woff2

GET sourcesanspro-600.605135ed81218e3c6926d6603a2aba14.woff2
ib.nab.com.au/reno/shell/v4.22.0/assets/ 0
0

GET
DATA 200
OK truncated
/ 14 KB
14 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 895b2a4707f964bde44b6543d155f6dc43ddf4bcff2dc46094789a7e313e07f0

Request headers

Referer
Origin: https://n-a-b-verify.web.app
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: font/woff2

GET
DATA 200
OK truncated
/ 29 KB
29 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 15435827eb508b00a5a473032738918ece0a1a6baba4f2a8832d9e8b8d886587

Request headers

Referer
Origin: https://n-a-b-verify.web.app
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: application/font-woff

GET
DATA 200
OK truncated
/ 44 KB
44 KB Font
application/font-sfnt

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a2d673fe34af57267a38b98a3f6f16b1f28758f407b3011089b6eb88e12856ec

Request headers

Referer
Origin: https://n-a-b-verify.web.app
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: application/font-sfnt

GET
DATA 200
OK truncated
/ 18 KB
18 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a97d10cefd0d747b1db289932dddd94f0e651b70a60af08de5e254539cb4ddec

Request headers

Referer
Origin: https://n-a-b-verify.web.app
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: font/woff2

GET
DATA 200
OK truncated
/ 29 KB
29 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1516e6b886bc6416bfec631059887732b3e34b4109380384a7fe83af0558f739

Request headers

Referer
Origin: https://n-a-b-verify.web.app
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: application/font-woff

GET sourcesanspro-regular-webfont.woff
ib.nab.com.au/nabib/styles/fonts/sourcesanspro/ 0
0

GET sourcesanspro-bold-webfont.woff
ib.nab.com.au/nabib/styles/fonts/sourcesanspro/ 0
0

GET sourcesanspro-regular-webfont.ttf
ib.nab.com.au/nabib/styles/fonts/sourcesanspro/ 0
0

GET sourcesanspro-semibold-webfont.woff
ib.nab.com.au/nabib/styles/fonts/sourcesanspro/ 0
0

GET sourcesanspro-bold-webfont.ttf
ib.nab.com.au/nabib/styles/fonts/sourcesanspro/ 0
0

GET sourcesanspro-semibold-webfont.ttf
ib.nab.com.au/nabib/styles/fonts/sourcesanspro/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: ib.nab.com.au
URL: https://ib.nab.com.au/reno/shell/v4.22.0/assets/sourcesanspro-400.58dd2a1c6d7861ea261912ba153ac8e3.woff2

Domain: ib.nab.com.au
URL: https://ib.nab.com.au/reno/shell/v4.22.0/assets/sourcesanspro-700.c18b7366babf6ace33427f60cf7fa7e0.woff2

Domain: ib.nab.com.au
URL: https://ib.nab.com.au/reno/shell/v4.22.0/assets/sourcesanspro-600.605135ed81218e3c6926d6603a2aba14.woff2

Domain: ib.nab.com.au
URL: https://ib.nab.com.au/nabib/styles/fonts/sourcesanspro/sourcesanspro-regular-webfont.woff

Domain: ib.nab.com.au
URL: https://ib.nab.com.au/nabib/styles/fonts/sourcesanspro/sourcesanspro-bold-webfont.woff

Domain: ib.nab.com.au
URL: https://ib.nab.com.au/nabib/styles/fonts/sourcesanspro/sourcesanspro-regular-webfont.ttf

Domain: ib.nab.com.au
URL: https://ib.nab.com.au/nabib/styles/fonts/sourcesanspro/sourcesanspro-semibold-webfont.woff

Domain: ib.nab.com.au
URL: https://ib.nab.com.au/nabib/styles/fonts/sourcesanspro/sourcesanspro-bold-webfont.ttf

Domain: ib.nab.com.au
URL: https://ib.nab.com.au/nabib/styles/fonts/sourcesanspro/sourcesanspro-semibold-webfont.ttf

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: NAB Bank (Banking)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			ib.nab.com.au/	1969-12-31 23:59:59	Name: akacd_ib_nab_com_au Value: 3834343640~rv=42~id=c6cbc7b604708679478dd92341402081

18 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://n-a-b-verify.web.app/ Message: Access to font at 'https://ib.nab.com.au/reno/shell/v4.22.0/assets/sourcesanspro-400.58dd2a1c6d7861ea261912ba153ac8e3.woff2' from origin 'https://n-a-b-verify.web.app' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://ib.nab.com.au/reno/shell/v4.22.0/assets/sourcesanspro-400.58dd2a1c6d7861ea261912ba153ac8e3.woff2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://n-a-b-verify.web.app/ Message: Access to font at 'https://ib.nab.com.au/reno/shell/v4.22.0/assets/sourcesanspro-700.c18b7366babf6ace33427f60cf7fa7e0.woff2' from origin 'https://n-a-b-verify.web.app' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://ib.nab.com.au/reno/shell/v4.22.0/assets/sourcesanspro-700.c18b7366babf6ace33427f60cf7fa7e0.woff2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://n-a-b-verify.web.app/ Message: Access to font at 'https://ib.nab.com.au/reno/shell/v4.22.0/assets/sourcesanspro-600.605135ed81218e3c6926d6603a2aba14.woff2' from origin 'https://n-a-b-verify.web.app' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://ib.nab.com.au/reno/shell/v4.22.0/assets/sourcesanspro-600.605135ed81218e3c6926d6603a2aba14.woff2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://n-a-b-verify.web.app/ Message: Access to font at 'https://ib.nab.com.au/nabib/styles/fonts/sourcesanspro/sourcesanspro-regular-webfont.woff' from origin 'https://n-a-b-verify.web.app' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://ib.nab.com.au/nabib/styles/fonts/sourcesanspro/sourcesanspro-regular-webfont.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://n-a-b-verify.web.app/ Message: Access to font at 'https://ib.nab.com.au/nabib/styles/fonts/sourcesanspro/sourcesanspro-bold-webfont.woff' from origin 'https://n-a-b-verify.web.app' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://ib.nab.com.au/nabib/styles/fonts/sourcesanspro/sourcesanspro-bold-webfont.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://n-a-b-verify.web.app/ Message: Access to font at 'https://ib.nab.com.au/nabib/styles/fonts/sourcesanspro/sourcesanspro-semibold-webfont.woff' from origin 'https://n-a-b-verify.web.app' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://ib.nab.com.au/nabib/styles/fonts/sourcesanspro/sourcesanspro-semibold-webfont.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://n-a-b-verify.web.app/ Message: Access to font at 'https://ib.nab.com.au/nabib/styles/fonts/sourcesanspro/sourcesanspro-regular-webfont.ttf' from origin 'https://n-a-b-verify.web.app' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://ib.nab.com.au/nabib/styles/fonts/sourcesanspro/sourcesanspro-regular-webfont.ttf Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://n-a-b-verify.web.app/ Message: Access to font at 'https://ib.nab.com.au/nabib/styles/fonts/sourcesanspro/sourcesanspro-bold-webfont.ttf' from origin 'https://n-a-b-verify.web.app' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://ib.nab.com.au/nabib/styles/fonts/sourcesanspro/sourcesanspro-bold-webfont.ttf Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://n-a-b-verify.web.app/ Message: Access to font at 'https://ib.nab.com.au/nabib/styles/fonts/sourcesanspro/sourcesanspro-semibold-webfont.ttf' from origin 'https://n-a-b-verify.web.app' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://ib.nab.com.au/nabib/styles/fonts/sourcesanspro/sourcesanspro-semibold-webfont.ttf Message: Failed to load resource: net::ERR_FAILED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ib.nab.com.au
n-a-b-verify.web.app
ib.nab.com.au
2620:0:890::100
96.16.133.121
0c25fae01f3d533727ed91660c352361177d60becaf1a9918829ba15ddc338e0
1516e6b886bc6416bfec631059887732b3e34b4109380384a7fe83af0558f739
15435827eb508b00a5a473032738918ece0a1a6baba4f2a8832d9e8b8d886587
1b38b540271daccc06d9b51ab31651bbdd940453e1b1de6555dfe9cad50eff11
1e5174af3db3b5e05fdc10059d98dc0949864ad66928208c7e1e18e85c2843ea
2cbc9c35d726f0896fd41ef7cbbb7dc2e12df23337e2697435df13a30dba42e4
3324a45c2fd599124f79dab9af2ea349742aa4ba438cd99972f9a77cb4f5577c
599d93e0748728edc6bd55a82a52bff61196b149d566a67d4ed86d55d9c520aa
6c784295f1e7b25d6c26f198e37fb9abf7ff9504dbdcaf626369ea4377da16d2
853f501c07636c1cf0ab27ea73f4e5845b495f950ded2b2fcd603d377a8b547c
895b2a4707f964bde44b6543d155f6dc43ddf4bcff2dc46094789a7e313e07f0
8a896aa0442917bb7d85724bf614b42ab9ff82ad1f6a970733b76f2b11bfee2e
9bb93aa94a3814a975a8d5a43e9fd77d1d494e8a760b5571dc92cc68c8b90942
9c985a29439b8fe255145d51808c30e01e9505b736a595332fa07f655a42bd0d
a07b6772c9e702f6f2b7b83e02f76515970eb54aeec4b7b7b00450a3b35594f3
a2d673fe34af57267a38b98a3f6f16b1f28758f407b3011089b6eb88e12856ec
a97d10cefd0d747b1db289932dddd94f0e651b70a60af08de5e254539cb4ddec
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6f1885aa9fc30aacc0f76863c02f30235305c44fb990ca1f02afa8a54dfd453
ea07872aaed934e600a19b6a02dbe59d12b79b1df101a65d365625646db3b273

n-a-b-verify.web.app Open in urlscan Pro 2620:0:890::100 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

18 Requests

50 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

640 kBTransfer

2518 kBSize

1 Cookies

0 Outgoing links

Redirected requests

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 11 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

18 JavaScript Global Variables

1 Cookies

18 Console Messages

Security Headers

Indicators

n-a-b-verify.web.app Open in urlscan Pro
2620:0:890::100 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

18
Requests

50 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

640 kB
Transfer

2518 kB
Size

1
Cookies

18 HTTP transactions
11 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!