naturesroots.biz
Open in
urlscan Pro
195.201.198.148
Malicious Activity!
Public Scan
Submission: On January 18 via automatic, source openphish
Summary
This is the only time naturesroots.biz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Simplii (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
32 | 195.201.198.148 195.201.198.148 | 24940 (HETZNER-AS) (HETZNER-AS) | |
2 | 8.20.172.40 8.20.172.40 | 13832 (AS13832) (AS13832 - Oracle Corporation) | |
34 | 2 |
ASN24940 (HETZNER-AS, DE)
PTR: static.148.198.201.195.clients.your-server.de
naturesroots.biz |
Apex Domain Subdomains |
Transfer | |
---|---|---|
32 |
naturesroots.biz
naturesroots.biz |
5 MB |
2 |
atgsvcs.com
rules.atgsvcs.com |
1 KB |
34 | 2 |
Domain | Requested by | |
---|---|---|
32 | naturesroots.biz |
naturesroots.biz
|
2 | rules.atgsvcs.com |
naturesroots.biz
|
34 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
www. |
locations. |
www.cibc.com |
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://naturesroots.biz/Refund943754/bank/simpli/details.htm
Frame ID: A868D65AA3C9D59CDFAAB2202476FEDC
Requests: 34 HTTP requests in this frame
Screenshot
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Ember.js (JavaScript Frameworks) Expand
Detected patterns
- env /^Ember$/i
RequireJS (JavaScript Frameworks) Expand
Detected patterns
- env /^requirejs$/i
Handlebars (JavaScript Frameworks) Expand
Detected patterns
- env /^Ember$/i
Moment.js (JavaScript Libraries) Expand
Detected patterns
- env /^moment$/i
SiteCatalyst (Analytics) Expand
Detected patterns
- env /^s_(?:account|objectID|code|INST)$/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- env /^jQuery$/i
Page Statistics
4 Outgoing links
These are links going to different origins than the main page.
Title: Today's Rates
Search URL Search Domain Scan URL
Title: Find an ATM
Search URL Search Domain Scan URL
Title: Legal and Privacy
Search URL Search Domain Scan URL
Title: CDIC Deposit Insurance Information
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
34 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
details.htm
naturesroots.biz/Refund943754/bank/simpli/ |
31 KB 31 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
vendor-239437d8e81009aaa93e57909e4961a2.css
naturesroots.biz/Refund943754/bank/simpli/Change%20Your%20Personal%20Verification%20Questions%20-%20Step%202%20-%20Simplii%20Financial%20-%20Online%20Banking_files/ |
10 KB 10 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ebanking-bee39651d9b3509ca759de667453412c.css
naturesroots.biz/Refund943754/bank/simpli/Change%20Your%20Personal%20Verification%20Questions%20-%20Step%202%20-%20Simplii%20Financial%20-%20Online%20Banking_files/ |
199 KB 199 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
atgsvcs.js
naturesroots.biz/Refund943754/bank/simpli/Change%20Your%20Personal%20Verification%20Questions%20-%20Step%202%20-%20Simplii%20Financial%20-%20Online%20Banking_files/ |
71 KB 72 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
vsapi.js
naturesroots.biz/Refund943754/bank/simpli/Change%20Your%20Personal%20Verification%20Questions%20-%20Step%202%20-%20Simplii%20Financial%20-%20Online%20Banking_files/ |
17 KB 17 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
vsopts.js
naturesroots.biz/Refund943754/bank/simpli/Change%20Your%20Personal%20Verification%20Questions%20-%20Step%202%20-%20Simplii%20Financial%20-%20Online%20Banking_files/ |
193 B 447 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
PAGE_LOAD
naturesroots.biz/Refund943754/bank/simpli/Change%20Your%20Personal%20Verification%20Questions%20-%20Step%202%20-%20Simplii%20Financial%20-%20Online%20Banking_files/ |
85 B 301 B |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
PAGE_LOAD(1)
naturesroots.biz/Refund943754/bank/simpli/Change%20Your%20Personal%20Verification%20Questions%20-%20Step%202%20-%20Simplii%20Financial%20-%20Online%20Banking_files/ |
85 B 301 B |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
PAGE_LOAD(2)
naturesroots.biz/Refund943754/bank/simpli/Change%20Your%20Personal%20Verification%20Questions%20-%20Step%202%20-%20Simplii%20Financial%20-%20Online%20Banking_files/ |
85 B 301 B |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pp.js
naturesroots.biz/Refund943754/bank/simpli/Change%20Your%20Personal%20Verification%20Questions%20-%20Step%202%20-%20Simplii%20Financial%20-%20Online%20Banking_files/ |
6 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ConditionalChatLink.css
naturesroots.biz/Refund943754/bank/simpli/Change%20Your%20Personal%20Verification%20Questions%20-%20Step%202%20-%20Simplii%20Financial%20-%20Online%20Banking_files/ |
851 B 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
PAGE_LOAD(3)
naturesroots.biz/Refund943754/bank/simpli/Change%20Your%20Personal%20Verification%20Questions%20-%20Step%202%20-%20Simplii%20Financial%20-%20Online%20Banking_files/ |
85 B 300 B |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
PAGE_LOAD(4)
naturesroots.biz/Refund943754/bank/simpli/Change%20Your%20Personal%20Verification%20Questions%20-%20Step%202%20-%20Simplii%20Financial%20-%20Online%20Banking_files/ |
85 B 300 B |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
PAGE_LOAD(5)
naturesroots.biz/Refund943754/bank/simpli/Change%20Your%20Personal%20Verification%20Questions%20-%20Step%202%20-%20Simplii%20Financial%20-%20Online%20Banking_files/ |
85 B 300 B |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
PAGE_LOAD(6)
naturesroots.biz/Refund943754/bank/simpli/Change%20Your%20Personal%20Verification%20Questions%20-%20Step%202%20-%20Simplii%20Financial%20-%20Online%20Banking_files/ |
85 B 300 B |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
RightNow.Client.js
naturesroots.biz/Refund943754/bank/simpli/Change%20Your%20Personal%20Verification%20Questions%20-%20Step%202%20-%20Simplii%20Financial%20-%20Online%20Banking_files/ |
60 KB 60 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
workaround.js
naturesroots.biz/Refund943754/bank/simpli/Change%20Your%20Personal%20Verification%20Questions%20-%20Step%202%20-%20Simplii%20Financial%20-%20Online%20Banking_files/ |
139 B 393 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
vendor-b70ea436cd8c0cc3c35c0cb7a6b824b1.js
naturesroots.biz/Refund943754/bank/simpli/Change%20Your%20Personal%20Verification%20Questions%20-%20Step%202%20-%20Simplii%20Financial%20-%20Online%20Banking_files/ |
814 KB 814 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ebanking-4df34c2309995c7ce569b386e385d160.js
naturesroots.biz/Refund943754/bank/simpli/Change%20Your%20Personal%20Verification%20Questions%20-%20Step%202%20-%20Simplii%20Financial%20-%20Online%20Banking_files/ |
4 MB 4 MB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
naturesroots.biz/Refund943754/bank/simpli/Change%20Your%20Personal%20Verification%20Questions%20-%20Step%202%20-%20Simplii%20Financial%20-%20Online%20Banking_files/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo-print.png
naturesroots.biz/Refund943754/bank/simpli/Change%20Your%20Personal%20Verification%20Questions%20-%20Step%202%20-%20Simplii%20Financial%20-%20Online%20Banking_files/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
CR45653-leftnav.png
naturesroots.biz/Refund943754/bank/simpli/Change%20Your%20Personal%20Verification%20Questions%20-%20Step%202%20-%20Simplii%20Financial%20-%20Online%20Banking_files/ |
37 KB 38 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
simpliichaticon.png
naturesroots.biz/Refund943754/bank/simpli/Change%20Your%20Personal%20Verification%20Questions%20-%20Step%202%20-%20Simplii%20Financial%20-%20Online%20Banking_files/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
xd.js
rules.atgsvcs.com/EERules/xd/3.0/json/200106300724/ |
84 B 480 B |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
toolbox-global-icon-summary.png
naturesroots.biz/Refund943754/bank/simpli/Change%20Your%20Personal%20Verification%20Questions%20-%20Step%202%20-%20Simplii%20Financial%20-%20Online%20Banking_files/img/ |
473 B 473 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
toolbox-global-icon-help.png
naturesroots.biz/Refund943754/bank/simpli/Change%20Your%20Personal%20Verification%20Questions%20-%20Step%202%20-%20Simplii%20Financial%20-%20Online%20Banking_files/img/ |
470 B 470 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ui-step-indicator-active-line.png
naturesroots.biz/Refund943754/bank/simpli/Change%20Your%20Personal%20Verification%20Questions%20-%20Step%202%20-%20Simplii%20Financial%20-%20Online%20Banking_files/img/uikit/ |
481 B 481 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ui-step-indicator-active-bg.png
naturesroots.biz/Refund943754/bank/simpli/Change%20Your%20Personal%20Verification%20Questions%20-%20Step%202%20-%20Simplii%20Financial%20-%20Online%20Banking_files/img/uikit/ |
479 B 479 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ui-select-icon.png
naturesroots.biz/Refund943754/bank/simpli/Change%20Your%20Personal%20Verification%20Questions%20-%20Step%202%20-%20Simplii%20Financial%20-%20Online%20Banking_files/img/uikit/ |
466 B 466 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
FSAlbertWeb-Bold.woff2
naturesroots.biz/Refund943754/bank/simpli/Change%20Your%20Personal%20Verification%20Questions%20-%20Step%202%20-%20Simplii%20Financial%20-%20Online%20Banking_files/fonts/FSAlbert/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
FSAlbertWeb-Regular.woff2
naturesroots.biz/Refund943754/bank/simpli/Change%20Your%20Personal%20Verification%20Questions%20-%20Step%202%20-%20Simplii%20Financial%20-%20Online%20Banking_files/fonts/FSAlbert/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
FSAlbertWeb-Bold.woff
naturesroots.biz/Refund943754/bank/simpli/Change%20Your%20Personal%20Verification%20Questions%20-%20Step%202%20-%20Simplii%20Financial%20-%20Online%20Banking_files/fonts/FSAlbert/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
FSAlbertWeb-Regular.woff
naturesroots.biz/Refund943754/bank/simpli/Change%20Your%20Personal%20Verification%20Questions%20-%20Step%202%20-%20Simplii%20Financial%20-%20Online%20Banking_files/fonts/FSAlbert/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
12FDL0fZS6nz-7uNrTk7ilMwUWiTyK0f9TDxqhjr5plPaFADF0A
rules.atgsvcs.com/EERules/view/rules/3.0/json/200106300724/ |
437 B 983 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Simplii (Banking)40 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask object| ATGSvcs object| _vsq object| RightNow object| _rnq function| EEInvoke object| VisitorService object| _adptr object| _throttler undefined| _timer object| _ATGSvcs object| CleverSet function| Visitor function| s_doPlugins function| AppMeasurement function| s_gi function| s_pgicq boolean| runningTests function| define function| requireModule function| require function| requirejs object| visitor object| s string| s_account object| EmberENV function| $ function| jQuery object| Ember object| Em object| DS function| moment function| Sortable object| s_c_il number| s_c_in number| s_objectID number| s_giq undefined| eStara_fsguid3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.naturesroots.biz/ | Name: atgRecSessionId Value: yjtgT8dGdNkAsNiX53se7rkAntm6xKHlRG-Nu7_FbaXcgyddNwOZ!-748252489!-897289587 |
|
.naturesroots.biz/ | Name: atgRecVisitorId Value: 12FDL0fZS6nz-7uNrTk7ilMwUWiTyK0f9TDxqhjr5plPaFADF0A |
|
.naturesroots.biz/ | Name: xdVisitorId Value: 12FDL0fZS6nz-7uNrTk7ilMwUWiTyK0f9TDxqhjr5plPaFADF0A |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
naturesroots.biz
rules.atgsvcs.com
195.201.198.148
8.20.172.40
1d5766f8a39a7dbac6c85f415397f2d33d739ad8e179907e5f2c412641fece41
21069f54900c4e52c02b93440b965630157fd6fab10a4379db7503fadab0b059
21de71d2c45e15f1d7e565294e94f3c9ad37793b4b84c7d739a92a4538b31507
2906b7074ad9d443198c5eacdb8c1bc694216b8e35055785b9a0ed617baba8dc
394da211a2993e9ac560fa5c916411dba81a1713e102b8b52608711e676f747d
48aabde3225e04937d34ea1eb79bcd7486681e4b52d4f2b4ca57b77d2e101ded
4dc26589dd6d6c4c46545a771f2bd2a743c541c2fec7307f673689c8ebbdea65
52d1daaea466524aa1c8d4d2cdad284853660930b894b68b3951c3b30ace818e
5b2415f00392662a8aaaf97ba4b5ef0982cb6cc0972a7e69b17a021d0fa0edcf
5cbe70e23dee470ac0aedd1645bf5c283dc2fa48ccc533c97eaf6e70f2a78b79
5ea5aab103772cd54f54fc48f3b405ecf7524cc13fd20c60597c6d47786190d1
6224b57cb10f8c0dab1d79d6e1363cb6e31f136d570f102041305fcc4cbfa588
6531e9bb7d562e73f2c786a3cc677a97381d018a35868adcb75507905b032f88
6f64da44c591d28fb36ba2eed1e8b814333103e9e1464f98d5ef031cd5a9764d
77aa5f62966d53e06af59c58eeb54eac5fe6d75ca6a5825855abf8a3f92c8475
8426f054b3d3b345b1d678f21218266bc74dca24af2866c38c8720ddd3898684
8ce64affc5611476a4b18d698abd8f06a171fb1a22b06d348a5e1c2ea2d5dc3b
9a5712d356380aa0a1449496ce889650e6dd72490e6e07b2d3f02b4acc218897
9fd17eebfb6cf30a23c8c1892cd8d3267df65004d281ea7d6fa7be4117b1c0bc
a06a26a19f96135a4766e77e8d716d8fdc01ecb317f5d2009c40de0549ae21f3
c8aae032e485ed9ce690ac6d20dde6b71e3adbe295ef658550457c495800c0af
f3afca828f69f37113ba1f0b97707b1372f9ac0f4334b437735ac9e180fe1715
f5fb47fdefacf8e7534c1e20946603fb030d1379bfc399ead6fd44fd96794502
fc09c446ad7e64900f02cf8a3b9def55a8be5bdb43625dcca82d37c04021af58