www.nab-activation.link Open in urlscan Pro
85.17.249.204 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.nab-activation.link/cgi/
Effective URL:
http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/
Submission: On March 31 via automatic, source openphish (March 31st 2017, 12:33:11 am UTC)

Summary HTTP 21 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 21 HTTP transactions. The main IP is 85.17.249.204, located in Netherlands and belongs to LEASEWEB-NL Netherlands, NL. The main domain is www.nab-activation.link.

This is the only time www.nab-activation.link was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: NAB Bank (Banking)

Domain & IP information

	IP Address		AS Autonomous System
21	85.17.249.204 85.17.249.204		60781 (LEASEWEB-...) (LEASEWEB-NL Netherlands)
21	1

21 85.17.249.204 (Netherlands)

ASN60781 (LEASEWEB-NL Netherlands, NL)
PTR: lw1462.ua-hosting.company

www.nab-activation.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
21	nab-activation.link www.nab-activation.link	227 KB
21	1

	Domain	Requested by
21	www.nab-activation.link	www.nab-activation.link
21	1

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/
Frame ID: 9957.1
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

21
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

227 kB
Transfer

227 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/ Redirect Chain http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/ http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/	10 KB 10 KB	18ms 18ms	Document text/html	85.17.249.204 LEASEWEB-NL Nethe...
General Check archive.org Show headers Download Go to Full URL http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/ Protocol HTTP/1.1 Server 85.17.249.204 , Netherlands, ASN60781 (LEASEWEB-NL Netherlands, NL), Reverse DNS lw1462.ua-hosting.company Software nginx/1.10.2 / PHP/7.0.17 Resource Hash `a0fb45122644652abfc9ec74cb19e65ff310f26b53acb059f960b7fd61021d20` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host www.nab-activation.link Accept-Language en-US,en;q=0.8 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Cache-Control no-cache Connection keep-alive User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Fri, 31 Mar 2017 00:33:01 GMT Server nginx/1.10.2 Connection keep-alive X-Powered-By PHP/7.0.17 Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Redirect headers location login/ Date Fri, 31 Mar 2017 00:33:01 GMT Server nginx/1.10.2 Connection keep-alive X-Powered-By PHP/7.0.17 Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	index.css www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/	17 KB 17 KB	27ms 14ms	Stylesheet text/css	85.17.249.204 LEASEWEB-NL Nethe...
General Check archive.org Show headers Download Go to Full URL http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/index.css Requested by Host: www.nab-activation.link URL: http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/ Protocol HTTP/1.1 Server 85.17.249.204 , Netherlands, ASN60781 (LEASEWEB-NL Netherlands, NL), Reverse DNS lw1462.ua-hosting.company Software nginx/1.10.2 / Resource Hash `c89a22106fc8a0a57b965b42dec1f7a481a8696a3cbde570914b53af0a5cbb59` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host www.nab-activation.link Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept text/css,/;q=0.1 Referer http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/ Connection keep-alive Cache-Control no-cache Referer http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Fri, 31 Mar 2017 00:33:01 GMT Last-Modified Fri, 31 Mar 2017 00:33:00 GMT Server nginx/1.10.2 ETag "58dda3bc-456a" Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 17770
GET H/1.1	200 OK	font-awesome.min.css www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/bower_components/font-awesome/css/	30 KB 30 KB	31ms 16ms	Stylesheet text/css	85.17.249.204 LEASEWEB-NL Nethe...
General Check archive.org Show headers Download Go to Full URL http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/bower_components/font-awesome/css/font-awesome.min.css Requested by Host: www.nab-activation.link URL: http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/ Protocol HTTP/1.1 Server 85.17.249.204 , Netherlands, ASN60781 (LEASEWEB-NL Netherlands, NL), Reverse DNS lw1462.ua-hosting.company Software nginx/1.10.2 / Resource Hash `799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host www.nab-activation.link Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept text/css,/;q=0.1 Referer http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/ Connection keep-alive Cache-Control no-cache Referer http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Fri, 31 Mar 2017 00:33:01 GMT Last-Modified Fri, 31 Mar 2017 00:32:58 GMT Server nginx/1.10.2 ETag "58dda3ba-7918" Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 31000
GET H/1.1	200 OK	jquery.min.js Show response www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/bower_components/jquery/dist/	85 KB 85 KB	32ms 16ms	Script application/javascript	85.17.249.204 LEASEWEB-NL Nethe...
General Check archive.org Show headers Download Go to Full URL http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/bower_components/jquery/dist/jquery.min.js Requested by Host: www.nab-activation.link URL: http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/ Protocol HTTP/1.1 Server 85.17.249.204 , Netherlands, ASN60781 (LEASEWEB-NL Netherlands, NL), Reverse DNS lw1462.ua-hosting.company Software nginx/1.10.2 / Resource Hash `85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host www.nab-activation.link Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept / Referer http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/ Connection keep-alive Cache-Control no-cache Referer http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Fri, 31 Mar 2017 00:33:01 GMT Last-Modified Fri, 31 Mar 2017 00:32:58 GMT Server nginx/1.10.2 ETag "58dda3ba-152b5" Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 86709
GET H/1.1	200 OK	logo_nab.png www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/	5 KB 5 KB	21ms 21ms	Image image/png	85.17.249.204 LEASEWEB-NL Nethe...
General Check archive.org Show headers Download Go to Show image Full URL http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/logo_nab.png Requested by Host: www.nab-activation.link URL: http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/ Protocol HTTP/1.1 Server 85.17.249.204 , Netherlands, ASN60781 (LEASEWEB-NL Netherlands, NL), Reverse DNS lw1462.ua-hosting.company Software nginx/1.10.2 / Resource Hash `c8b5c36b604b175f0c6be6b98f40c5b82c05b0a76aadd383a61b0f4fe0b3d264` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host www.nab-activation.link Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/ Connection keep-alive Cache-Control no-cache Referer http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Fri, 31 Mar 2017 00:33:01 GMT Last-Modified Fri, 31 Mar 2017 00:33:00 GMT Server nginx/1.10.2 ETag "58dda3bc-134f" Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 4943
GET H/1.1	200 OK	nab_defence.gif www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/	3 KB 3 KB	14ms 14ms	Image image/gif	85.17.249.204 LEASEWEB-NL Nethe...
General Check archive.org Show headers Download Go to Show image Full URL http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/nab_defence.gif Requested by Host: www.nab-activation.link URL: http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/ Protocol HTTP/1.1 Server 85.17.249.204 , Netherlands, ASN60781 (LEASEWEB-NL Netherlands, NL), Reverse DNS lw1462.ua-hosting.company Software nginx/1.10.2 / Resource Hash `c4d9a3125d8ae44072e64b39bacde45a74d6157c5d8b7e965b9a919739338e84` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host www.nab-activation.link Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/ Connection keep-alive Cache-Control no-cache Referer http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Fri, 31 Mar 2017 00:33:01 GMT Last-Modified Fri, 31 Mar 2017 00:33:00 GMT Server nginx/1.10.2 ETag "58dda3bc-ab5" Content-Type image/gif Connection keep-alive Accept-Ranges bytes Content-Length 2741
GET H/1.1	200 OK	gr_arrow-1.png www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/	154 B 154 B	14ms 14ms	Image image/png	85.17.249.204 LEASEWEB-NL Nethe...
General Check archive.org Show headers Download Go to Show image Full URL http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/gr_arrow-1.png Requested by Host: www.nab-activation.link URL: http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/ Protocol HTTP/1.1 Server 85.17.249.204 , Netherlands, ASN60781 (LEASEWEB-NL Netherlands, NL), Reverse DNS lw1462.ua-hosting.company Software nginx/1.10.2 / Resource Hash `c7a299c1e3976b682508aeac5138f2f31b289d350e94bbd3ccc4f7570b67dcd0` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host www.nab-activation.link Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/index.css Connection keep-alive Cache-Control no-cache Referer http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/index.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Fri, 31 Mar 2017 00:33:01 GMT Last-Modified Fri, 31 Mar 2017 00:33:00 GMT Server nginx/1.10.2 ETag "58dda3bc-9a" Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 154
GET H/1.1	200 OK	bg_banner-2.jpg www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/	19 KB 19 KB	15ms 15ms	Image image/jpeg	85.17.249.204 LEASEWEB-NL Nethe...
General Check archive.org Show headers Download Go to Show image Full URL http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/bg_banner-2.jpg Requested by Host: www.nab-activation.link URL: http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/ Protocol HTTP/1.1 Server 85.17.249.204 , Netherlands, ASN60781 (LEASEWEB-NL Netherlands, NL), Reverse DNS lw1462.ua-hosting.company Software nginx/1.10.2 / Resource Hash `04ff4054aedfdc46f0358f8f145717259c3d264f78837b8eb3bdb46024315947` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host www.nab-activation.link Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/index.css Connection keep-alive Cache-Control no-cache Referer http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/index.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Fri, 31 Mar 2017 00:33:01 GMT Last-Modified Fri, 31 Mar 2017 00:33:00 GMT Server nginx/1.10.2 ETag "58dda3bc-4a28" Content-Type image/jpeg Connection keep-alive Accept-Ranges bytes Content-Length 18984
GET H/1.1	200 OK	corpid-b-webfont_001.woff www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/	25 KB 25 KB	15ms 15ms	Font application/font-woff	85.17.249.204 LEASEWEB-NL Nethe...
General Check archive.org Show headers Download Go to Full URL http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/corpid-b-webfont_001.woff Requested by Host: www.nab-activation.link URL: http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/ Protocol HTTP/1.1 Server 85.17.249.204 , Netherlands, ASN60781 (LEASEWEB-NL Netherlands, NL), Reverse DNS lw1462.ua-hosting.company Software nginx/1.10.2 / Resource Hash `38db52c7406151339645f1d9e6642be7e31f97457fad34b541bcee77e58d54ac` Request headers Pragma no-cache Origin http://www.nab-activation.link Accept-Encoding gzip, deflate, sdch Host www.nab-activation.link Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept / Referer http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/index.css Connection keep-alive Cache-Control no-cache User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Referer http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/index.css Origin http://www.nab-activation.link Response headers Date Fri, 31 Mar 2017 00:33:01 GMT Last-Modified Fri, 31 Mar 2017 00:33:01 GMT Server nginx/1.10.2 ETag "58dda3bd-6360" Content-Type application/font-woff Connection keep-alive Accept-Ranges bytes Content-Length 25440
GET H/1.1	200 OK	corpid-l-webfont_001.woff www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/	27 KB 27 KB	15ms 15ms	Font application/font-woff	85.17.249.204 LEASEWEB-NL Nethe...
General Check archive.org Show headers Download Go to Full URL http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/corpid-l-webfont_001.woff Requested by Host: www.nab-activation.link URL: http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/ Protocol HTTP/1.1 Server 85.17.249.204 , Netherlands, ASN60781 (LEASEWEB-NL Netherlands, NL), Reverse DNS lw1462.ua-hosting.company Software nginx/1.10.2 / Resource Hash `680ebc1aecd70eb8791e9fca7d92e873fc94f820c3c22fd38441da7a266db279` Request headers Pragma no-cache Origin http://www.nab-activation.link Accept-Encoding gzip, deflate, sdch Host www.nab-activation.link Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept / Referer http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/index.css Connection keep-alive Cache-Control no-cache User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Referer http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/index.css Origin http://www.nab-activation.link Response headers Date Fri, 31 Mar 2017 00:33:01 GMT Last-Modified Fri, 31 Mar 2017 00:33:00 GMT Server nginx/1.10.2 ETag "58dda3bc-6cc0" Content-Type application/font-woff Connection keep-alive Accept-Ranges bytes Content-Length 27840
GET H/1.1	200 OK	bg_input_user.gif www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/	257 B 257 B	44ms 15ms	Image image/gif	85.17.249.204 LEASEWEB-NL Nethe...
General Check archive.org Show headers Download Go to Show image Full URL http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/bg_input_user.gif Requested by Host: www.nab-activation.link URL: http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/ Protocol HTTP/1.1 Server 85.17.249.204 , Netherlands, ASN60781 (LEASEWEB-NL Netherlands, NL), Reverse DNS lw1462.ua-hosting.company Software nginx/1.10.2 / Resource Hash `4c27e00efc3a284d6406cbe4838292288fd65fb135cb303902e682e7a7a5f473` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host www.nab-activation.link Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/index.css Connection keep-alive Cache-Control no-cache Referer http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/index.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Fri, 31 Mar 2017 00:33:01 GMT Last-Modified Fri, 31 Mar 2017 00:33:00 GMT Server nginx/1.10.2 ETag "58dda3bc-101" Content-Type image/gif Connection keep-alive Accept-Ranges bytes Content-Length 257
GET H/1.1	200 OK	ico_sprite_001.gif www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/	2 KB 2 KB	44ms 14ms	Image image/gif	85.17.249.204 LEASEWEB-NL Nethe...
General Check archive.org Show headers Download Go to Show image Full URL http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/ico_sprite_001.gif Requested by Host: www.nab-activation.link URL: http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/ Protocol HTTP/1.1 Server 85.17.249.204 , Netherlands, ASN60781 (LEASEWEB-NL Netherlands, NL), Reverse DNS lw1462.ua-hosting.company Software nginx/1.10.2 / Resource Hash `a0f7466886559e2f009b59c21c80021e45a6b9911f5e25a6e96879c16b269b72` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host www.nab-activation.link Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/index.css Connection keep-alive Cache-Control no-cache Referer http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/index.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Fri, 31 Mar 2017 00:33:01 GMT Last-Modified Fri, 31 Mar 2017 00:33:00 GMT Server nginx/1.10.2 ETag "58dda3bc-6ba" Content-Type image/gif Connection keep-alive Accept-Ranges bytes Content-Length 1722
GET H/1.1	200 OK	img_bg_lg_btn_press.gif www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/	307 B 307 B	22ms 14ms	Image image/gif	85.17.249.204 LEASEWEB-NL Nethe...
General Check archive.org Show headers Download Go to Show image Full URL http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/img_bg_lg_btn_press.gif Requested by Host: www.nab-activation.link URL: http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/ Protocol HTTP/1.1 Server 85.17.249.204 , Netherlands, ASN60781 (LEASEWEB-NL Netherlands, NL), Reverse DNS lw1462.ua-hosting.company Software nginx/1.10.2 / Resource Hash `0be93ba9b93250bde05417c35f0e453cc6ca03b5ad40168b63dd7f419a08a5a2` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host www.nab-activation.link Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/index.css Connection keep-alive Cache-Control no-cache Referer http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/index.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Fri, 31 Mar 2017 00:33:01 GMT Last-Modified Fri, 31 Mar 2017 00:33:01 GMT Server nginx/1.10.2 ETag "58dda3bd-133" Content-Type image/gif Connection keep-alive Accept-Ranges bytes Content-Length 307
GET H/1.1	200 OK	bg_arrow_black.gif www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/	100 B 100 B	15ms 14ms	Image image/gif	85.17.249.204 LEASEWEB-NL Nethe...
General Check archive.org Show headers Download Go to Show image Full URL http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/bg_arrow_black.gif Requested by Host: www.nab-activation.link URL: http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/ Protocol HTTP/1.1 Server 85.17.249.204 , Netherlands, ASN60781 (LEASEWEB-NL Netherlands, NL), Reverse DNS lw1462.ua-hosting.company Software nginx/1.10.2 / Resource Hash `4f48fca9a73368362a7356a8d3fdcc86b40a174b7b83c80b059a9322d0619e47` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host www.nab-activation.link Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/index.css Connection keep-alive Cache-Control no-cache Referer http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/index.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Fri, 31 Mar 2017 00:33:01 GMT Last-Modified Fri, 31 Mar 2017 00:33:00 GMT Server nginx/1.10.2 ETag "58dda3bc-64" Content-Type image/gif Connection keep-alive Accept-Ranges bytes Content-Length 100
GET H/1.1	200 OK	gr_bg_btn01_001.gif www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/	274 B 274 B	20ms 14ms	Image image/gif	85.17.249.204 LEASEWEB-NL Nethe...
General Check archive.org Show headers Download Go to Show image Full URL http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/gr_bg_btn01_001.gif Requested by Host: www.nab-activation.link URL: http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/ Protocol HTTP/1.1 Server 85.17.249.204 , Netherlands, ASN60781 (LEASEWEB-NL Netherlands, NL), Reverse DNS lw1462.ua-hosting.company Software nginx/1.10.2 / Resource Hash `047532b80749cd876978ef5149876f804837410fbc2ad12b79857f34622e2583` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host www.nab-activation.link Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/index.css Connection keep-alive Cache-Control no-cache Referer http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/index.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Fri, 31 Mar 2017 00:33:01 GMT Last-Modified Fri, 31 Mar 2017 00:33:00 GMT Server nginx/1.10.2 ETag "58dda3bc-112" Content-Type image/gif Connection keep-alive Accept-Ranges bytes Content-Length 274
GET H/1.1	200 OK	gr_dot-1.gif www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/	68 B 68 B	31ms 12ms	Image image/gif	85.17.249.204 LEASEWEB-NL Nethe...
General Check archive.org Show headers Download Go to Show image Full URL http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/gr_dot-1.gif Requested by Host: www.nab-activation.link URL: http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/ Protocol HTTP/1.1 Server 85.17.249.204 , Netherlands, ASN60781 (LEASEWEB-NL Netherlands, NL), Reverse DNS lw1462.ua-hosting.company Software nginx/1.10.2 / Resource Hash `aded0530b852996f0f6d0bdee146023d096aa2c7990805c8f1f90456172b7892` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host www.nab-activation.link Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/index.css Connection keep-alive Cache-Control no-cache Referer http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/index.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Fri, 31 Mar 2017 00:33:01 GMT Last-Modified Fri, 31 Mar 2017 00:33:00 GMT Server nginx/1.10.2 ETag "58dda3bc-44" Content-Type image/gif Connection keep-alive Accept-Ranges bytes Content-Length 68
GET H/1.1	200 OK	footer-icon-facebook.gif www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/	581 B 581 B	19ms 12ms	Image image/gif	85.17.249.204 LEASEWEB-NL Nethe...
General Check archive.org Show headers Download Go to Show image Full URL http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/footer-icon-facebook.gif Requested by Host: www.nab-activation.link URL: http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/ Protocol HTTP/1.1 Server 85.17.249.204 , Netherlands, ASN60781 (LEASEWEB-NL Netherlands, NL), Reverse DNS lw1462.ua-hosting.company Software nginx/1.10.2 / Resource Hash `b59dac6fad9c97244268d80748845bb6efac3bac4999809675e742e21c0cfac4` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host www.nab-activation.link Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/index.css Connection keep-alive Cache-Control no-cache Referer http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/index.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Fri, 31 Mar 2017 00:33:01 GMT Last-Modified Fri, 31 Mar 2017 00:33:00 GMT Server nginx/1.10.2 ETag "58dda3bc-245" Content-Type image/gif Connection keep-alive Accept-Ranges bytes Content-Length 581
GET H/1.1	200 OK	footer-icon-twitter.gif www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/	449 B 449 B	34ms 14ms	Image image/gif	85.17.249.204 LEASEWEB-NL Nethe...
General Check archive.org Show headers Download Go to Show image Full URL http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/footer-icon-twitter.gif Requested by Host: www.nab-activation.link URL: http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/ Protocol HTTP/1.1 Server 85.17.249.204 , Netherlands, ASN60781 (LEASEWEB-NL Netherlands, NL), Reverse DNS lw1462.ua-hosting.company Software nginx/1.10.2 / Resource Hash `740b92b37caf1906cd34828753b3c60f3f92fa7d89c172a757ae8ddb229c413b` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host www.nab-activation.link Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/index.css Connection keep-alive Cache-Control no-cache Referer http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/index.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Fri, 31 Mar 2017 00:33:01 GMT Last-Modified Fri, 31 Mar 2017 00:33:00 GMT Server nginx/1.10.2 ETag "58dda3bc-1c1" Content-Type image/gif Connection keep-alive Accept-Ranges bytes Content-Length 449
GET H/1.1	200 OK	footer-icon-gplus.gif www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/	1 KB 1 KB	21ms 14ms	Image image/gif	85.17.249.204 LEASEWEB-NL Nethe...
General Check archive.org Show headers Download Go to Show image Full URL http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/footer-icon-gplus.gif Requested by Host: www.nab-activation.link URL: http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/ Protocol HTTP/1.1 Server 85.17.249.204 , Netherlands, ASN60781 (LEASEWEB-NL Netherlands, NL), Reverse DNS lw1462.ua-hosting.company Software nginx/1.10.2 / Resource Hash `345e5797bde0b78107d25a3ab912482a2009a90dcc37c61e10f04bdf90a5c9e6` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host www.nab-activation.link Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/index.css Connection keep-alive Cache-Control no-cache Referer http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/index.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Fri, 31 Mar 2017 00:33:01 GMT Last-Modified Fri, 31 Mar 2017 00:33:00 GMT Server nginx/1.10.2 ETag "58dda3bc-416" Content-Type image/gif Connection keep-alive Accept-Ranges bytes Content-Length 1046
GET H/1.1	200 OK	footer-icon-youtube.gif www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/	1 KB 1 KB	35ms 14ms	Image image/gif	85.17.249.204 LEASEWEB-NL Nethe...
General Check archive.org Show headers Download Go to Show image Full URL http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/footer-icon-youtube.gif Requested by Host: www.nab-activation.link URL: http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/ Protocol HTTP/1.1 Server 85.17.249.204 , Netherlands, ASN60781 (LEASEWEB-NL Netherlands, NL), Reverse DNS lw1462.ua-hosting.company Software nginx/1.10.2 / Resource Hash `4b0f8a88bea8e8300faf9c6eb50d989aed7b008262dd482f78ed3e340251adc5` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host www.nab-activation.link Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/index.css Connection keep-alive Cache-Control no-cache Referer http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/index.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Fri, 31 Mar 2017 00:33:01 GMT Last-Modified Fri, 31 Mar 2017 00:33:00 GMT Server nginx/1.10.2 ETag "58dda3bc-4b0" Content-Type image/gif Connection keep-alive Accept-Ranges bytes Content-Length 1200
GET H/1.1	404 Not Found	favicon.ico www.nab-activation.link/	571 B 571 B	18ms 17ms	Other text/html	85.17.249.204 LEASEWEB-NL Nethe...
General Check archive.org Show headers Download Go to Full URL http://www.nab-activation.link/favicon.ico Protocol HTTP/1.1 Server 85.17.249.204 , Netherlands, ASN60781 (LEASEWEB-NL Netherlands, NL), Reverse DNS lw1462.ua-hosting.company Software nginx/1.10.2 / Resource Hash `206f42d520769f5a05fa12453b0f4d567026fbe55bde8620043bef201b7f9540` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host www.nab-activation.link Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/ Connection keep-alive Cache-Control no-cache Referer http://www.nab-activation.link/cgi/61c20458710cce2003641caed0906bad/login/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Fri, 31 Mar 2017 00:33:01 GMT Server nginx/1.10.2 Connection keep-alive Content-Length 571 Content-Type text/html

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: NAB Bank (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.nab-activation.link
85.17.249.204
047532b80749cd876978ef5149876f804837410fbc2ad12b79857f34622e2583
04ff4054aedfdc46f0358f8f145717259c3d264f78837b8eb3bdb46024315947
0be93ba9b93250bde05417c35f0e453cc6ca03b5ad40168b63dd7f419a08a5a2
206f42d520769f5a05fa12453b0f4d567026fbe55bde8620043bef201b7f9540
345e5797bde0b78107d25a3ab912482a2009a90dcc37c61e10f04bdf90a5c9e6
38db52c7406151339645f1d9e6642be7e31f97457fad34b541bcee77e58d54ac
4b0f8a88bea8e8300faf9c6eb50d989aed7b008262dd482f78ed3e340251adc5
4c27e00efc3a284d6406cbe4838292288fd65fb135cb303902e682e7a7a5f473
4f48fca9a73368362a7356a8d3fdcc86b40a174b7b83c80b059a9322d0619e47
680ebc1aecd70eb8791e9fca7d92e873fc94f820c3c22fd38441da7a266db279
740b92b37caf1906cd34828753b3c60f3f92fa7d89c172a757ae8ddb229c413b
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
a0f7466886559e2f009b59c21c80021e45a6b9911f5e25a6e96879c16b269b72
a0fb45122644652abfc9ec74cb19e65ff310f26b53acb059f960b7fd61021d20
aded0530b852996f0f6d0bdee146023d096aa2c7990805c8f1f90456172b7892
b59dac6fad9c97244268d80748845bb6efac3bac4999809675e742e21c0cfac4
c4d9a3125d8ae44072e64b39bacde45a74d6157c5d8b7e965b9a919739338e84
c7a299c1e3976b682508aeac5138f2f31b289d350e94bbd3ccc4f7570b67dcd0
c89a22106fc8a0a57b965b42dec1f7a481a8696a3cbde570914b53af0a5cbb59
c8b5c36b604b175f0c6be6b98f40c5b82c05b0a76aadd383a61b0f4fe0b3d264

www.nab-activation.link Open in urlscan Pro 85.17.249.204 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

21 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

227 kBTransfer

227 kBSize

0 Cookies

0 Outgoing links

Redirected requests

21 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

www.nab-activation.link Open in urlscan Pro
85.17.249.204 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

21
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

227 kB
Transfer

227 kB
Size

0
Cookies

21 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!