urlscan.io logo urlscan.io
SecurityTrails logo

registration-assistance.net Open in urlscan Pro
178.208.77.95  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://registration-assistance.net/
Submission: On November 28 via api from GB — Scanned from GB
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 4 countries across 5 domains to perform 10 HTTP transactions. The main IP is 178.208.77.95, located in Russian Federation and belongs to EUROBYTE Eurobyte LLC, RU. The main domain is registration-assistance.net.
This is the only time registration-assistance.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Santander (Banking)

Domain & IP information

IP Address AS Autonomous System
1 178.208.77.95 210079 (EUROBYTE ...)
1 2001:4de0:ac1... 20446 (HIGHWINDS3)
3 185.126.226.146 9009 (M247)
4 193.127.210.129 2134 (GSVNET-AS...)
1 52.22.109.225 14618 (AMAZON-AES)
10 5
1    178.208.77.95 (Russian Federation)

ASN210079 (EUROBYTE Eurobyte LLC, RU)
PTR: hosted-by.mchost.ru
registration-assistance.net
1    2001:4de0:ac18::1:a:3a (Netherlands)

ASN20446 (HIGHWINDS3, US)
code.jquery.com
3    185.126.226.146 (Amsterdam, Netherlands)

ASN9009 (M247, GB)
db.onlinewebfonts.com
4    193.127.210.129 (Milton Keynes, United Kingdom)

ASN2134 (GSVNET-AS GS Virtual Network Produban, ES)
retail.santander.co.uk
1    52.22.109.225 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-22-109-225.compute-1.amazonaws.com
events.splash-screen.net
Domain Requested by
4 retail.santander.co.uk registration-assistance.net
3 db.onlinewebfonts.com registration-assistance.net
db.onlinewebfonts.com
1 events.splash-screen.net registration-assistance.net
1 code.jquery.com registration-assistance.net
1 registration-assistance.net
10 5

This site contains links to these domains. Also see Links.

Domain
www.santander.co.uk
business.santander.co.uk
corporate.santander.co.uk
onetrust.com
Subject Issuer Validity Valid
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA		 2021-07-14 -
2022-08-14		 a year crt.sh
retail.santander.co.uk
Entrust Certification Authority - L1M		 2021-03-08 -
2022-04-04		 a year crt.sh
*.splash-screen.net
DigiCert TLS RSA SHA256 2020 CA1		 2021-03-04 -
2022-03-09		 a year crt.sh

This page contains 1 frames:

Primary Page: http://registration-assistance.net/
Frame ID: B4723FC3B0A5406B9423ADDBC71028FF
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Personal Online Banking: Log on or sign upBack ButtonSearch IconFilter IconArrow

Page Statistics

10
Requests

60 %
HTTPS

20 %
IPv6

5
Domains

5
Subdomains

5
IPs

4
Countries

313 kB
Transfer

507 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
registration-assistance.net/ 		150 KB
151 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://registration-assistance.net/
Protocol
HTTP/1.1
Server
178.208.77.95 , Russian Federation, ASN210079 (EUROBYTE Eurobyte LLC, RU),
Reverse DNS
hosted-by.mchost.ru
Software
Apache /
Resource Hash
e78a5eae6a57fdb2b3514146f8e942300b6bfc838accda2a9d8d03de4265a36a

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36
Accept-Language
en-GB,en;q=0.9

Response headers

Date
Sun, 28 Nov 2021 09:32:02 GMT
Server
Apache
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate
Pragma
no-cache
Connection
close
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
jquery-3.1.1.min.js
code.jquery.com/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.1.1.min.js
Requested by
Host: registration-assistance.net
URL: http://registration-assistance.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac18::1:a:3a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
nginx /
Resource Hash
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

Request headers

Referer
http://registration-assistance.net/
Origin
http://registration-assistance.net
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

date
Sun, 28 Nov 2021 09:32:02 GMT
content-encoding
gzip
last-modified
Thu, 22 Sep 2016 22:32:34 GMT
server
nginx
etag
W/"57e45c02-152b5"
vary
Accept-Encoding
x-hw
1638091922.dop024.ml1.t,1638091922.cds216.ml1.hn,1638091922.cds204.ml1.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
30070
058d42bfae0ddfbe480af070188ce3e8
db.onlinewebfonts.com/c/ 		1 KB
861 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://db.onlinewebfonts.com/c/058d42bfae0ddfbe480af070188ce3e8?family=SantanderHeadlineW05-Bold
Requested by
Host: registration-assistance.net
URL: http://registration-assistance.net/
Protocol
HTTP/1.1
Server
185.126.226.146 Amsterdam, Netherlands, ASN9009 (M247, GB),
Reverse DNS
Software
nginx / PHP/5.4.45
Resource Hash
1324dc9f42a55aba7440eec2db249a67e9ba03a5256f2351d8fe7f0b9e707727

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
http://registration-assistance.net/
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

Date
Sun, 28 Nov 2021 09:31:04 GMT
Content-Encoding
gzip
Server
nginx
X-Powered-By
PHP/5.4.45
Vary
Accept-Encoding, Accept-Encoding
Access-Control-Allow-Methods
GET,POST,OPTIONS
Content-Type
text/css
Access-Control-Allow-Origin
*
Cache-Control
public,max-age=86400,must-revalidate
Transfer-Encoding
chunked
Connection
keep-alive
Access-Control-Allow-Headers
X-Requested-With
dbe98f282aedd7682f9e1fac27daa2e1
db.onlinewebfonts.com/c/ 		1 KB
854 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://db.onlinewebfonts.com/c/dbe98f282aedd7682f9e1fac27daa2e1?family=Santander+Logo+Light
Requested by
Host: registration-assistance.net
URL: http://registration-assistance.net/
Protocol
HTTP/1.1
Server
185.126.226.146 Amsterdam, Netherlands, ASN9009 (M247, GB),
Reverse DNS
Software
nginx / PHP/5.4.45
Resource Hash
12a236397be6a4311581dd121693638bb0db72c1066118605a73a93318089ca1

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
http://registration-assistance.net/
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

Date
Sun, 28 Nov 2021 09:31:04 GMT
Content-Encoding
gzip
Server
nginx
X-Powered-By
PHP/5.4.45
Vary
Accept-Encoding, Accept-Encoding
Access-Control-Allow-Methods
GET,POST,OPTIONS
Content-Type
text/css
Access-Control-Allow-Origin
*
Cache-Control
public,max-age=86400,must-revalidate
Transfer-Encoding
chunked
Connection
keep-alive
Access-Control-Allow-Headers
X-Requested-With
styles.fc7bf3186e36bfa9492e.css
retail.santander.co.uk/olb/app/logon/access/ 		181 KB
38 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://retail.santander.co.uk/olb/app/logon/access/styles.fc7bf3186e36bfa9492e.css
Requested by
Host: registration-assistance.net
URL: http://registration-assistance.net/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
193.127.210.129 Milton Keynes, United Kingdom, ASN2134 (GSVNET-AS GS Virtual Network Produban, ES),
Reverse DNS
Software
/
Resource Hash
dd5c4a5f236c106751a0b9df9da19c72372f7bf05a61f7614196bfad186ea389

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
http://registration-assistance.net/
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

Date
Sun, 28 Nov 2021 09:32:03 GMT
Content-Encoding
gzip
Last-Modified
Wed, 10 Mar 2021 11:01:41 GMT
ETag
W/"6048a715-2d363"
Transfer-Encoding
chunked
Content-Type
text/css
Cache-Control
max-age=31536000, public, private
Server-Timing
dtRpid;desc="-675206814"
Expires
Mon, 28 Nov 2022 09:32:03 GMT
header-logo.png
retail.santander.co.uk/olb/app/logon/access/assets/images/ 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://retail.santander.co.uk/olb/app/logon/access/assets/images/header-logo.png
Requested by
Host: registration-assistance.net
URL: http://registration-assistance.net/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
193.127.210.129 Milton Keynes, United Kingdom, ASN2134 (GSVNET-AS GS Virtual Network Produban, ES),
Reverse DNS
Software
/
Resource Hash
f700c3638638b62b07e614c8cae5665cf4bfa956452ab4e6fea5a15965fc40f7

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
http://registration-assistance.net/
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

Date
Sun, 28 Nov 2021 09:32:06 GMT
Last-Modified
Wed, 10 Mar 2021 11:01:41 GMT
ETag
"6048a715-aeb"
Content-Type
image/png
Cache-Control
max-age=2592000, public, private
Server-Timing
dtRpid;desc="1086793610"
Accept-Ranges
bytes
Content-Length
2795
Expires
Tue, 28 Dec 2021 09:32:06 GMT
asset-3-3-x@2x.png
retail.santander.co.uk/olb/app/logon/access/assets/images/ 		77 KB
78 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://retail.santander.co.uk/olb/app/logon/access/assets/images/asset-3-3-x@2x.png
Requested by
Host: registration-assistance.net
URL: http://registration-assistance.net/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
193.127.210.129 Milton Keynes, United Kingdom, ASN2134 (GSVNET-AS GS Virtual Network Produban, ES),
Reverse DNS
Software
/
Resource Hash
08f86c6496d80636195dd2e2037f5c141f65ed6b969514531e61512ea239c5d8

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
http://registration-assistance.net/
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

Date
Sun, 28 Nov 2021 09:32:06 GMT
Last-Modified
Wed, 10 Mar 2021 11:01:41 GMT
ETag
"6048a715-133b2"
Content-Type
image/png
Cache-Control
max-age=2592000, public, private
Server-Timing
dtRpid;desc="-1806101979"
Accept-Ranges
bytes
Content-Length
78770
Expires
Tue, 28 Dec 2021 09:32:06 GMT
asset-2.png
retail.santander.co.uk/olb/app/logon/access/assets/images/ 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://retail.santander.co.uk/olb/app/logon/access/assets/images/asset-2.png
Requested by
Host: registration-assistance.net
URL: http://registration-assistance.net/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
193.127.210.129 Milton Keynes, United Kingdom, ASN2134 (GSVNET-AS GS Virtual Network Produban, ES),
Reverse DNS
Software
/
Resource Hash
1bca034dc76dab33232d41f7f9705fced08c4b48c90e23bd737e4b610d1b6df8

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
http://registration-assistance.net/
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

Date
Sun, 28 Nov 2021 09:32:06 GMT
Last-Modified
Wed, 10 Mar 2021 11:01:41 GMT
ETag
"6048a715-df1"
Content-Type
image/png
Cache-Control
max-age=2592000, public, private
Server-Timing
dtRpid;desc="1910958103"
Accept-Ranges
bytes
Content-Length
3569
Expires
Tue, 28 Dec 2021 09:32:06 GMT
/
events.splash-screen.net/splash_events/ 		0
103 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://events.splash-screen.net/splash_events/?business=rcing_santanderuk&application=santanderuk_personal_20140304&key=97123&event=close&sub_event=close_button
Requested by
Host: registration-assistance.net
URL: http://registration-assistance.net/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.22.109.225 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-22-109-225.compute-1.amazonaws.com
Software
haile /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
http://registration-assistance.net/
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

Connection
keep-alive
Date
Sun, 28 Nov 2021 09:32:07 GMT
Server
haile
dbe98f282aedd7682f9e1fac27daa2e1.woff2
db.onlinewebfonts.com/t/ 		6 KB
7 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://db.onlinewebfonts.com/t/dbe98f282aedd7682f9e1fac27daa2e1.woff2
Requested by
Host: db.onlinewebfonts.com
URL: http://db.onlinewebfonts.com/c/dbe98f282aedd7682f9e1fac27daa2e1?family=Santander+Logo+Light
Protocol
HTTP/1.1
Server
185.126.226.146 Amsterdam, Netherlands, ASN9009 (M247, GB),
Reverse DNS
Software
nginx / PHP/5.4.45
Resource Hash
8fa111129c20b326d73332e5702145876f59aadf230fe2f7fabbbe3836599400

Request headers

Referer
http://db.onlinewebfonts.com/c/dbe98f282aedd7682f9e1fac27daa2e1?family=Santander+Logo+Light
Origin
http://registration-assistance.net
Accept-Language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.185 Mobile Safari/537.36

Response headers

Date
Sun, 28 Nov 2021 09:31:07 GMT
Server
nginx
X-Powered-By
PHP/5.4.45
Transfer-Encoding
chunked
Access-Control-Allow-Methods
GET,POST,OPTIONS
Content-Type
application/x-font-woff
Access-Control-Allow-Origin
*
Cache-Control
public,max-age=86400,must-revalidate
Connection
keep-alive
Access-Control-Allow-Headers
X-Requested-With

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Santander (Banking)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler function| $ function| jQuery object| submitButton boolean| can_proceed_pid boolean| can_proceed_snum

1 Cookies

Domain/Path Name / Value
registration-assistance.net/ Name: PHPSESSID
Value: fa11530ea527190d47156ad0762105e9

1 Console Messages

Source Level URL
Text
rendering warning URL: http://registration-assistance.net/(Line 33)
Message:
The key "inital-scale" is not recognized and ignored.