haireleganceutah.com Open in urlscan Pro
209.59.191.190 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://haireleganceutah.com/ntc/natwest3/mobile/security.php
Effective URL:
https://haireleganceutah.com/ntc/natwest3/mobile/security.php
Submission: On May 28 via api (May 28th 2024, 9:52:33 am UTC) from US — Scanned from DE

Summary HTTP 17 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 17 HTTP transactions. The main IP is 209.59.191.190, located in United States and belongs to LIQUIDWEB, US. The main domain is haireleganceutah.com.
TLS certificate: Issued by R3 on April 5th 2024. Valid for: 3 months.

This is the only time haireleganceutah.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: NatWest (Banking)

Domain & IP information

	IP Address		AS Autonomous System
17	209.59.191.190 209.59.191.190		32244 (LIQUIDWEB) (LIQUIDWEB)
17	1

17 209.59.191.190 (United States)

ASN32244 (LIQUIDWEB, US)
PTR: alt2-dory.exacthosting.com

haireleganceutah.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
17	haireleganceutah.com haireleganceutah.com	294 KB
17	1

	Domain	Requested by
17	haireleganceutah.com	haireleganceutah.com
17	1

This site contains no links.

Subject Issuer	Validity	Valid
*.haireleganceutah.com R3	`2024-04-05` - `2024-07-04`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://haireleganceutah.com/ntc/natwest3/mobile/security.php
Frame ID: A83C753BCAA4EAC77BE64F1ECF11F004
Requests: 3 HTTP requests in this frame

Frame: https://haireleganceutah.com/ntc/natwest3/mobile/security_files/security.php
Frame ID: D3AC691CBA7398BB24202774D98EAD7B
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Security

Page URL History Show full URLs

http://haireleganceutah.com/ntc/natwest3/mobile/security.php HTTP 307
https://haireleganceutah.com/ntc/natwest3/mobile/security.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

17
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

294 kB
Transfer

292 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://haireleganceutah.com/ntc/natwest3/mobile/security.php HTTP 307
https://haireleganceutah.com/ntc/natwest3/mobile/security.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request security.php Show response haireleganceutah.com/ntc/natwest3/mobile/ Redirect Chain http://haireleganceutah.com/ntc/natwest3/mobile/security.php https://haireleganceutah.com/ntc/natwest3/mobile/security.php	958 B 1 KB	379ms 126ms	Document text/html	209.59.191.190 LIQUIDWEB
General Check archive.org Show headers Download Go to Full URL https://haireleganceutah.com/ntc/natwest3/mobile/security.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 209.59.191.190 , United States, ASN32244 (LIQUIDWEB, US), Reverse DNS alt2-dory.exacthosting.com Software Apache / Resource Hash `02754664c68c7f62f72ec95d4c382e1cadc82ab903ae00b5a8e640f89f31b446` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Response headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Tue, 28 May 2024 09:52:29 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=2, max=500 Pragma no-cache Server Apache Transfer-Encoding chunked Redirect headers Location https://haireleganceutah.com/ntc/natwest3/mobile/security.php Non-Authoritative-Reason HttpsUpgrades
GET H/1.1	200 OK	security.php Show response haireleganceutah.com/ntc/natwest3/mobile/security_files/ Frame D3AC	25 KB 25 KB	127ms 127ms	Document text/html	209.59.191.190 LIQUIDWEB
General Check archive.org Show headers Download Go to Full URL https://haireleganceutah.com/ntc/natwest3/mobile/security_files/security.php Requested by Host: haireleganceutah.com URL: https://haireleganceutah.com/ntc/natwest3/mobile/security.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 209.59.191.190 , United States, ASN32244 (LIQUIDWEB, US), Reverse DNS alt2-dory.exacthosting.com Software Apache / Resource Hash `44f747ab81f893ad8b228b862935ec1afaacbb983180b5dbaa4fd38226eee280` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer https://haireleganceutah.com/ntc/natwest3/mobile/security.php Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Tue, 28 May 2024 09:52:29 GMT Keep-Alive timeout=2, max=499 Server Apache Transfer-Encoding chunked
GET H/1.1	200 OK	master.css haireleganceutah.com/ntc/natwest3/mobile/security_files/ Frame D3AC	133 KB 133 KB	224ms 115ms	Stylesheet text/css	209.59.191.190 LIQUIDWEB
General Check archive.org Show headers Download Go to Full URL https://haireleganceutah.com/ntc/natwest3/mobile/security_files/master.css Requested by Host: haireleganceutah.com URL: https://haireleganceutah.com/ntc/natwest3/mobile/security_files/security.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 209.59.191.190 , United States, ASN32244 (LIQUIDWEB, US), Reverse DNS alt2-dory.exacthosting.com Software Apache / Resource Hash `75b00a583c89310d12ace059629526ba7cfbb0bd4509ec5750a25fd6ffdd6e12` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://haireleganceutah.com/ntc/natwest3/mobile/security_files/security.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 28 May 2024 09:52:29 GMT Last-Modified Sat, 07 Jul 2018 13:16:38 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=498 Content-Length 135744
GET H/1.1	200 OK	datePicker.css haireleganceutah.com/ntc/natwest3/mobile/security_files/ Frame D3AC	2 KB 3 KB	344ms 115ms	Stylesheet text/css	209.59.191.190 LIQUIDWEB
General Check archive.org Show headers Download Go to Full URL https://haireleganceutah.com/ntc/natwest3/mobile/security_files/datePicker.css Requested by Host: haireleganceutah.com URL: https://haireleganceutah.com/ntc/natwest3/mobile/security_files/security.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 209.59.191.190 , United States, ASN32244 (LIQUIDWEB, US), Reverse DNS alt2-dory.exacthosting.com Software Apache / Resource Hash `14714f651128eff786763144294b0e7c67529d317ac5371632bbf8fb659866ff` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://haireleganceutah.com/ntc/natwest3/mobile/security_files/security.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 28 May 2024 09:52:29 GMT Last-Modified Sat, 07 Jul 2018 13:16:36 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=500 Content-Length 2384
GET H/1.1	200 OK	npc.css haireleganceutah.com/ntc/natwest3/mobile/security_files/ Frame D3AC	46 KB 46 KB	344ms 116ms	Stylesheet text/css	209.59.191.190 LIQUIDWEB
General Check archive.org Show headers Download Go to Full URL https://haireleganceutah.com/ntc/natwest3/mobile/security_files/npc.css Requested by Host: haireleganceutah.com URL: https://haireleganceutah.com/ntc/natwest3/mobile/security_files/security.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 209.59.191.190 , United States, ASN32244 (LIQUIDWEB, US), Reverse DNS alt2-dory.exacthosting.com Software Apache / Resource Hash `990f073c20457aa8ecb56a57304e16c90ec7eadb63f25e64932b2f1914054d4a` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://haireleganceutah.com/ntc/natwest3/mobile/security_files/security.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 28 May 2024 09:52:29 GMT Last-Modified Sat, 07 Jul 2018 13:16:38 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=500 Content-Length 47357
GET H/1.1	200 OK	overlayPromptMaster.css haireleganceutah.com/ntc/natwest3/mobile/security_files/ Frame D3AC	2 KB 2 KB	345ms 116ms	Stylesheet text/css	209.59.191.190 LIQUIDWEB
General Check archive.org Show headers Download Go to Full URL https://haireleganceutah.com/ntc/natwest3/mobile/security_files/overlayPromptMaster.css Requested by Host: haireleganceutah.com URL: https://haireleganceutah.com/ntc/natwest3/mobile/security_files/security.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 209.59.191.190 , United States, ASN32244 (LIQUIDWEB, US), Reverse DNS alt2-dory.exacthosting.com Software Apache / Resource Hash `643d4d52a1a24515822f6a30683f901bb5dd16c251d88caece27ab2713457272` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://haireleganceutah.com/ntc/natwest3/mobile/security_files/security.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 28 May 2024 09:52:29 GMT Last-Modified Sat, 07 Jul 2018 13:16:38 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=500 Content-Length 1538
GET H/1.1	200 OK	overlayPrompt.css haireleganceutah.com/ntc/natwest3/mobile/security_files/ Frame D3AC	76 B 316 B	346ms 116ms	Stylesheet text/css	209.59.191.190 LIQUIDWEB
General Check archive.org Show headers Download Go to Full URL https://haireleganceutah.com/ntc/natwest3/mobile/security_files/overlayPrompt.css Requested by Host: haireleganceutah.com URL: https://haireleganceutah.com/ntc/natwest3/mobile/security_files/security.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 209.59.191.190 , United States, ASN32244 (LIQUIDWEB, US), Reverse DNS alt2-dory.exacthosting.com Software Apache / Resource Hash `ef7db794b4a6b5c42d2535919d91fb11da1e5cd1147f35196db382197b35fdee` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://haireleganceutah.com/ntc/natwest3/mobile/security_files/security.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 28 May 2024 09:52:29 GMT Last-Modified Sat, 07 Jul 2018 13:16:38 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=500 Content-Length 76
GET H/1.1	200 OK	master_mobile.css haireleganceutah.com/ntc/natwest3/mobile/security_files/ Frame D3AC	18 KB 18 KB	349ms 118ms	Stylesheet text/css	209.59.191.190 LIQUIDWEB
General Check archive.org Show headers Download Go to Full URL https://haireleganceutah.com/ntc/natwest3/mobile/security_files/master_mobile.css Requested by Host: haireleganceutah.com URL: https://haireleganceutah.com/ntc/natwest3/mobile/security_files/security.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 209.59.191.190 , United States, ASN32244 (LIQUIDWEB, US), Reverse DNS alt2-dory.exacthosting.com Software Apache / Resource Hash `8d19ce7511c97d861471b938de9d7a3375599c0326f5ea6d72a362ebbded1bcd` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://haireleganceutah.com/ntc/natwest3/mobile/security_files/security.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 28 May 2024 09:52:29 GMT Last-Modified Sat, 07 Jul 2018 13:16:38 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=500 Content-Length 18658
GET H/1.1	200 OK	NPC_auralstyle.css haireleganceutah.com/ntc/natwest3/mobile/security_files/ Frame D3AC	515 B 756 B	117ms 117ms	Stylesheet text/css	209.59.191.190 LIQUIDWEB
General Check archive.org Show headers Download Go to Full URL https://haireleganceutah.com/ntc/natwest3/mobile/security_files/NPC_auralstyle.css Requested by Host: haireleganceutah.com URL: https://haireleganceutah.com/ntc/natwest3/mobile/security_files/security.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 209.59.191.190 , United States, ASN32244 (LIQUIDWEB, US), Reverse DNS alt2-dory.exacthosting.com Software Apache / Resource Hash `04c45c81e1298e703f3bde9cec27446450294330ae06bd24c9f9343b264462e9` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://haireleganceutah.com/ntc/natwest3/mobile/security_files/security.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 28 May 2024 09:52:30 GMT Last-Modified Sat, 07 Jul 2018 13:16:38 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=499 Content-Length 515
GET H/1.1	200 OK	master_print.css haireleganceutah.com/ntc/natwest3/mobile/security_files/ Frame D3AC	5 KB 6 KB	118ms 118ms	Stylesheet text/css	209.59.191.190 LIQUIDWEB
General Check archive.org Show headers Download Go to Full URL https://haireleganceutah.com/ntc/natwest3/mobile/security_files/master_print.css Requested by Host: haireleganceutah.com URL: https://haireleganceutah.com/ntc/natwest3/mobile/security_files/security.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 209.59.191.190 , United States, ASN32244 (LIQUIDWEB, US), Reverse DNS alt2-dory.exacthosting.com Software Apache / Resource Hash `1acd7d03edc5d90866fd012355c352efbb02f38c9334cffd4a9f321b4d713491` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://haireleganceutah.com/ntc/natwest3/mobile/security_files/security.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 28 May 2024 09:52:30 GMT Last-Modified Sat, 07 Jul 2018 13:16:38 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=497 Content-Length 5612
GET H/1.1	200 OK	logo.png haireleganceutah.com/ntc/natwest3/mobile/security_files/ Frame D3AC	3 KB 3 KB	335ms 114ms	Image image/png	209.59.191.190 LIQUIDWEB
General Check archive.org Show headers Download Go to Show image Full URL https://haireleganceutah.com/ntc/natwest3/mobile/security_files/logo.png Requested by Host: haireleganceutah.com URL: https://haireleganceutah.com/ntc/natwest3/mobile/security_files/security.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 209.59.191.190 , United States, ASN32244 (LIQUIDWEB, US), Reverse DNS alt2-dory.exacthosting.com Software Apache / Resource Hash `917942589e5b140755ee83bb4720ca9c1bbf7705f44f51a78ba1ffa635420c50` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://haireleganceutah.com/ntc/natwest3/mobile/security_files/security.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 28 May 2024 09:52:30 GMT Last-Modified Sat, 07 Jul 2018 13:16:38 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=499 Content-Length 3053
GET H/1.1	200 OK	alert-icon.png haireleganceutah.com/ntc/natwest3/mobile/security_files/ Frame D3AC	638 B 880 B	115ms 115ms	Image image/png	209.59.191.190 LIQUIDWEB
General Check archive.org Show headers Download Go to Show image Full URL https://haireleganceutah.com/ntc/natwest3/mobile/security_files/alert-icon.png Requested by Host: haireleganceutah.com URL: https://haireleganceutah.com/ntc/natwest3/mobile/security_files/security.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 209.59.191.190 , United States, ASN32244 (LIQUIDWEB, US), Reverse DNS alt2-dory.exacthosting.com Software Apache / Resource Hash `d4901081a59d75050d215c08d6fd5370cea9aa1eaea023a176c9b9c26760f221` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://haireleganceutah.com/ntc/natwest3/mobile/security_files/security.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 28 May 2024 09:52:30 GMT Last-Modified Sat, 07 Jul 2018 13:16:34 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=499 Content-Length 638
GET H/1.1	200 OK	exit-icon-white.svg haireleganceutah.com/ntc/natwest3/mobile/security_files/ Frame D3AC	641 B 887 B	115ms 115ms	Image image/svg+xml	209.59.191.190 LIQUIDWEB
General Check archive.org Show headers Download Go to Show image Full URL https://haireleganceutah.com/ntc/natwest3/mobile/security_files/exit-icon-white.svg Requested by Host: haireleganceutah.com URL: https://haireleganceutah.com/ntc/natwest3/mobile/security_files/master.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 209.59.191.190 , United States, ASN32244 (LIQUIDWEB, US), Reverse DNS alt2-dory.exacthosting.com Software Apache / Resource Hash `43a780414ddf2b15e9b47811bbaa8cbfc6cf56d4db65684ed114a1c2a13bc097` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://haireleganceutah.com/ntc/natwest3/mobile/security_files/master.css Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 28 May 2024 09:52:30 GMT Last-Modified Sat, 07 Jul 2018 13:16:36 GMT Server Apache Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=496 Content-Length 641
GET H/1.1	200 OK	RNHouseSansW03-Regular.woff haireleganceutah.com/ntc/natwest3/mobile/security_files/ Frame D3AC	25 KB 25 KB	114ms 113ms	Font font/woff	209.59.191.190 LIQUIDWEB
General Check archive.org Show headers Download Go to Full URL https://haireleganceutah.com/ntc/natwest3/mobile/security_files/RNHouseSansW03-Regular.woff Requested by Host: haireleganceutah.com URL: https://haireleganceutah.com/ntc/natwest3/mobile/security_files/npc.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 209.59.191.190 , United States, ASN32244 (LIQUIDWEB, US), Reverse DNS alt2-dory.exacthosting.com Software Apache / Resource Hash `37539c1b025b1580975ce7942ff711e4e92e6f549af893e46e5a9a60e705c02c` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://haireleganceutah.com/ntc/natwest3/mobile/security_files/npc.css Origin https://haireleganceutah.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 28 May 2024 09:52:30 GMT Last-Modified Sat, 07 Jul 2018 13:16:40 GMT Server Apache Content-Type font/woff Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=499 Content-Length 25612
GET H/1.1	200 OK	RNHouseSansW03-Bold.woff haireleganceutah.com/ntc/natwest3/mobile/security_files/ Frame D3AC	26 KB 26 KB	117ms 116ms	Font font/woff	209.59.191.190 LIQUIDWEB
General Check archive.org Show headers Download Go to Full URL https://haireleganceutah.com/ntc/natwest3/mobile/security_files/RNHouseSansW03-Bold.woff Requested by Host: haireleganceutah.com URL: https://haireleganceutah.com/ntc/natwest3/mobile/security_files/npc.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 209.59.191.190 , United States, ASN32244 (LIQUIDWEB, US), Reverse DNS alt2-dory.exacthosting.com Software Apache / Resource Hash `ce87bf8a3058e5028a4b64dc0aa16e0614f7e47d87223594c6353450aadbf5ad` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://haireleganceutah.com/ntc/natwest3/mobile/security_files/npc.css Origin https://haireleganceutah.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 28 May 2024 09:52:30 GMT Last-Modified Sat, 07 Jul 2018 13:16:40 GMT Server Apache Content-Type font/woff Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=499 Content-Length 26144
GET H/1.1	200 OK	favicon.ico haireleganceutah.com/ntc/natwest3/mobile/security_files/	2 KB 2 KB	115ms 115ms	Other image/x-icon	209.59.191.190 LIQUIDWEB
General Check archive.org Show headers Download Go to Full URL https://haireleganceutah.com/ntc/natwest3/mobile/security_files/favicon.ico Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 209.59.191.190 , United States, ASN32244 (LIQUIDWEB, US), Reverse DNS alt2-dory.exacthosting.com Software Apache / Resource Hash `9bbf91204e8022d01c859c92c1d9218ac4859de521548856534b48ac2e7849a8` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://haireleganceutah.com/ntc/natwest3/mobile/security.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 28 May 2024 09:52:30 GMT Last-Modified Sat, 07 Jul 2018 13:16:36 GMT Server Apache Content-Type image/x-icon Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=498 Content-Length 2238
GET H/1.1	200 OK	favicon.ico haireleganceutah.com/ntc/natwest3/mobile/security_files/	2 KB 0	0ms 0ms	Other image/x-icon	209.59.191.190 LIQUIDWEB
General Check archive.org Show headers Download Go to Full URL https://haireleganceutah.com/ntc/natwest3/mobile/security_files/favicon.ico Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 209.59.191.190 , United States, ASN32244 (LIQUIDWEB, US), Reverse DNS alt2-dory.exacthosting.com Software Apache / Resource Hash `9bbf91204e8022d01c859c92c1d9218ac4859de521548856534b48ac2e7849a8` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://haireleganceutah.com/ntc/natwest3/mobile/security.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 28 May 2024 09:52:30 GMT Last-Modified Sat, 07 Jul 2018 13:16:36 GMT Server Apache Accept-Ranges bytes Content-Length 2238 Content-Type image/x-icon

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: NatWest (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			haireleganceutah.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 7d38b81e76fcf3e00c3beb161311c7d0

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://haireleganceutah.com/ntc/natwest3/mobile/security_files/security.php Message: [DOM] Multiple forms should be contained in their own form elements; break up complex forms into ones that represent a single action: (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

haireleganceutah.com
209.59.191.190
02754664c68c7f62f72ec95d4c382e1cadc82ab903ae00b5a8e640f89f31b446
04c45c81e1298e703f3bde9cec27446450294330ae06bd24c9f9343b264462e9
14714f651128eff786763144294b0e7c67529d317ac5371632bbf8fb659866ff
1acd7d03edc5d90866fd012355c352efbb02f38c9334cffd4a9f321b4d713491
37539c1b025b1580975ce7942ff711e4e92e6f549af893e46e5a9a60e705c02c
43a780414ddf2b15e9b47811bbaa8cbfc6cf56d4db65684ed114a1c2a13bc097
44f747ab81f893ad8b228b862935ec1afaacbb983180b5dbaa4fd38226eee280
643d4d52a1a24515822f6a30683f901bb5dd16c251d88caece27ab2713457272
75b00a583c89310d12ace059629526ba7cfbb0bd4509ec5750a25fd6ffdd6e12
8d19ce7511c97d861471b938de9d7a3375599c0326f5ea6d72a362ebbded1bcd
917942589e5b140755ee83bb4720ca9c1bbf7705f44f51a78ba1ffa635420c50
990f073c20457aa8ecb56a57304e16c90ec7eadb63f25e64932b2f1914054d4a
9bbf91204e8022d01c859c92c1d9218ac4859de521548856534b48ac2e7849a8
ce87bf8a3058e5028a4b64dc0aa16e0614f7e47d87223594c6353450aadbf5ad
d4901081a59d75050d215c08d6fd5370cea9aa1eaea023a176c9b9c26760f221
ef7db794b4a6b5c42d2535919d91fb11da1e5cd1147f35196db382197b35fdee

haireleganceutah.com Open in urlscan Pro 209.59.191.190 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

17 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

294 kBTransfer

292 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

haireleganceutah.com Open in urlscan Pro
209.59.191.190 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

294 kB
Transfer

292 kB
Size

1
Cookies

17 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!