wealth-stg.metafaq.com
Open in
urlscan Pro
91.207.38.123
Malicious Activity!
Public Scan
Submitted URL: https://wealth-stg.metafaq.com/
Effective URL: https://wealth-stg.metafaq.com/help/international/
Submission: On October 29 via api from BY — Scanned from GB
Effective URL: https://wealth-stg.metafaq.com/help/international/
Submission: On October 29 via api from BY — Scanned from GB
Summary
This website contacted 3 IPs
in 2 countries
across 2 domains to perform 10 HTTP transactions.
The main IP is 91.207.38.123, located in
United Kingdom and
belongs to TCL-AS, GB.
The main domain is wealth-stg.metafaq.com.
TLS certificate: Issued by R11 on September 23rd 2024. Valid for: 3 months.
This is the only time wealth-stg.metafaq.com was scanned on urlscan.io!
TLS certificate: Issued by R11 on September 23rd 2024. Valid for: 3 months.
This is the only time wealth-stg.metafaq.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Barclays (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 2 11 | 91.207.38.123 91.207.38.123 | 47999 (TCL-AS) (TCL-AS) | |
| 1 | 2a00:1450:400... 2a00:1450:4001:808::200a | 15169 (GOOGLE) (GOOGLE) | |
| 10 | 3 |
11
91.207.38.123
(United Kingdom)
ASN47999 (TCL-AS, GB)
PTR: barclays-sso.metafaq.com
ASN47999 (TCL-AS, GB)
PTR: barclays-sso.metafaq.com
| wealth-stg.metafaq.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 11 |
metafaq.com
2 redirects
wealth-stg.metafaq.com |
146 KB |
| 1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 412 |
31 KB |
| 10 | 2 |
| Domain | Requested by | |
|---|---|---|
| 11 | wealth-stg.metafaq.com |
2 redirects
wealth-stg.metafaq.com
|
| 1 | ajax.googleapis.com |
wealth-stg.metafaq.com
|
| 10 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| bank.barclays.co.uk |
| www.wealthdirect.barclays |
| ciiom.barclays.com |
| international.barclays.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| verint-km.com R11 |
2024-09-23 - 2024-12-22 |
3 months | crt.sh |
| upload.video.google.com WR2 |
2024-10-07 - 2024-12-30 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://wealth-stg.metafaq.com/help/international/
Frame ID: A7C4A320396A4FF1E592D56BDD17DA3F
Requests: 15 HTTP requests in this frame
Screenshot
Page Title
Barclays WealthPage URL History Show full URLs
-
https://wealth-stg.metafaq.com/
HTTP 301
https://wealth-stg.metafaq.com/help/ HTTP 301
https://wealth-stg.metafaq.com/help/international/ Page URL
Detected technologies
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
10 Outgoing links
These are links going to different origins than the main page.
URL: https://bank.barclays.co.uk/olb/authlogin/loginAppContainer.do?mbrtyp=pbc#/identification
Title: Log in to Online Banking
Title: Log in to Online Banking
Search URL Search Domain Scan URL
URL: https://www.wealthdirect.barclays/auth/login?Location=%2Fafp%2Fgroup%2Fbarclays%2Fwealth
Title: Log in to Online Investment Service
Title: Log in to Online Investment Service
Search URL Search Domain Scan URL
URL: https://ciiom.barclays.com/
Title: Isle of Man, Jersey and Guernsey clients
Title: Isle of Man, Jersey and Guernsey clients
Search URL Search Domain Scan URL
URL: https://international.barclays.com/
Title: International clients
Title: International clients
Search URL Search Domain Scan URL
URL: https://international.barclays.com/important-information/
Title: Important information
Title: Important information
Search URL Search Domain Scan URL
URL: https://international.barclays.com/important-information/terms-and-conditions/
Title: Terms of Use
Title: Terms of Use
Search URL Search Domain Scan URL
URL: https://international.barclays.com/important-information/privacy-policy/
Title: Privacy Policy
Title: Privacy Policy
Search URL Search Domain Scan URL
URL: https://international.barclays.com/important-information/cookies/
Title: Cookie Policy
Title: Cookie Policy
Search URL Search Domain Scan URL
URL: https://international.barclays.com/security/
Title: Security
Title: Security
Search URL Search Domain Scan URL
URL: https://international.barclays.com/important-information/accessibility/
Title: Accessibility
Title: Accessibility
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://wealth-stg.metafaq.com/
HTTP 301
https://wealth-stg.metafaq.com/help/ HTTP 301
https://wealth-stg.metafaq.com/help/international/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
wealth-stg.metafaq.com/help/international/ Redirect Chain
|
22 KB 23 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
styles.css
wealth-stg.metafaq.com/help/static/6673cd20/css/ |
62 KB 63 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.6.0/ |
87 KB 31 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
stats.lib.js
wealth-stg.metafaq.com/help/static/6673cd20/js/ |
5 KB 5 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
print.css
wealth-stg.metafaq.com/help/static/6673cd20/css/ |
455 B 996 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
scripts.js
wealth-stg.metafaq.com/help/static/6673cd20/js/ |
8 KB 9 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logStatistics
wealth-stg.metafaq.com/action/ |
42 B 863 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
353 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
expertsans-light-webfont.woff2
wealth-stg.metafaq.com/help/static/6673cd20/fonts/ |
19 KB 19 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
expertsans-regular-webfont.woff2
wealth-stg.metafaq.com/help/static/6673cd20/fonts/ |
18 KB 19 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
barclays.ico
wealth-stg.metafaq.com/help/static/6673cd20/img/ |
5 KB 6 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Barclays (Banking)21 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery object| actions object| stats string| url object| settings object| defaults function| checkOptions function| pushObject function| callStats object| httpRequest function| makeRequest function| merge_options string| STATSUSERGROUP string| CLIENTPATH string| BASEPATH object| search function| no_e function| change_links object| mfOpts object| $a2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| wealth-stg.metafaq.com/ | Name: identitytoken Value: R1RL67G8IF26H4AQV6MCV5EQHM |
|
| wealth-stg.metafaq.com/ | Name: vsid Value: eyJpdiI6IjhNUGRMQTdQd2JxdnYyeWgxeXlwSFE9PSIsInZhbHVlIjoiSmwyTTNBamRVOFdvOThBWEFiNXAyNHlHZVZtZzh1S3Z4a2VtaFd1ZG5Wamt0elwvZktHVTRsQmNKTmZGbVVcL1NkTEZuS1FBSzJROExmeXhsSUdiQXkxUT09IiwibWFjIjoiMmJiOTViMjA1ZjMxNGUyZDY2ZDU3YmQzOTBhMDBlMjg2YjcyMWIzOWZjYzQxYWI0MmY0MDcwMjRkZTdmMTYyZiJ9 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| Strict-Transport-Security | max-age=31536000; includeSubDomains |
| X-Frame-Options | DENY |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
wealth-stg.metafaq.com
2a00:1450:4001:808::200a
91.207.38.123
3d7ce653272cbfd5104f3818d3e13489fad4efe65220ee09debeea7a803deac9
471fd5ece469cdeb904d2ed40a8aaa2f1f620004df7fdb2627268a855ee60504
6a2b78f59745dd52a04eacbf4cce6cf38847ca2c3e5103f7df916771db023d7e
6b4f2bc5c90d5be0a0f9ba042388674db405fad67d94810f05557bd6e485b04f
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
7057b221ff358226b4975e5df49680b4b9a7e92cb63f56192d679986b2c931b0
75c073ea0b409393a7dd0cb2b279f479d4e2cfd082bd77c6e417ab6af2f49e71
763dfbf448a28b6e6d65faf5f747e2167485961f40eb032997808b4b2a3f4a28
8c21ca2a4e2540325f8313a0acd93cbbabf5643c3e3bdf408c9493033d03b981
91a06213190743f440aa3411f1393afaf3de8b3b6309d6677fb7680248f09e91
e111be4c24fc0743ca7eb1c4873a64bb234135b9bea86cabd922a5caabb6c9c6
e352d5926c0041969b3a77607fbf793d41369dbb36fad61842723f1b91c02671
f8a045e019844b44d3051c475ca30a5b21ff5a4641ea129dea53fcefc591bd93
fc21380148dd0527f2f878e174129d947bf8e877977eda7fcf207676a03d613c
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e