www.santanderonetrade.com
Open in
urlscan Pro
2a02:26f0:eb::5f64:b508
Malicious Activity!
Public Scan
Effective URL: https://www.santanderonetrade.com/s/login/?language=en_US
Submission Tags: @phishunt_io
Submission: On December 17 via api from ES
Summary
TLS certificate: Issued by R3 on December 16th 2020. Valid for: 3 months.
This is the only time www.santanderonetrade.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Santander (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 19 | 2a02:26f0:eb:... 2a02:26f0:eb::5f64:b508 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
2 | 65.9.68.91 65.9.68.91 | 16509 (AMAZON-02) (AMAZON-02) | |
7 | 34.247.72.187 34.247.72.187 | 16509 (AMAZON-02) (AMAZON-02) | |
27 | 4 |
ASN16509 (AMAZON-02, US)
PTR: ec2-34-247-72-187.eu-west-1.compute.amazonaws.com
bf99314cet.bf.dynatrace.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
19 |
santanderonetrade.com
2 redirects
www.santanderonetrade.com |
858 KB |
9 |
dynatrace.com
js-cdn.dynatrace.com bf99314cet.bf.dynatrace.com |
112 KB |
27 | 2 |
Domain | Requested by | |
---|---|---|
19 | www.santanderonetrade.com |
2 redirects
www.santanderonetrade.com
js-cdn.dynatrace.com |
7 | bf99314cet.bf.dynatrace.com |
js-cdn.dynatrace.com
|
2 | js-cdn.dynatrace.com |
www.santanderonetrade.com
js-cdn.dynatrace.com |
27 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
prod.24.slot.cdn.salesforce-communities.com R3 |
2020-12-16 - 2021-03-16 |
3 months | crt.sh |
js-cdn.dynatrace.com Amazon |
2020-05-01 - 2021-06-01 |
a year | crt.sh |
*.bf.dynatrace.com Amazon |
2020-03-07 - 2021-04-07 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.santanderonetrade.com/s/login/?language=en_US
Frame ID: 3086F03D5C22FDF2FE143978CB5FDAC8
Requests: 26 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://www.santanderonetrade.com/ Page URL
-
https://www.santanderonetrade.com/s/login
HTTP 302
https://www.santanderonetrade.com/s/login/ HTTP 301
https://www.santanderonetrade.com/s/login/?language=en_US Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://www.santanderonetrade.com/ Page URL
-
https://www.santanderonetrade.com/s/login
HTTP 302
https://www.santanderonetrade.com/s/login/ HTTP 301
https://www.santanderonetrade.com/s/login/?language=en_US Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
27 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
www.santanderonetrade.com/ |
497 B 725 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
www.santanderonetrade.com/s/login/ Redirect Chain
|
65 KB 17 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.css
www.santanderonetrade.com/s/sfsites/l/%7B%22mode%22%3A%22PROD%22%2C%22app%22%3A%22siteforce%3AloginApp2%22%2C%22loaded%22%3A%7B%22APPLICATION%40markup%3A%2F%2Fsiteforce%3AloginApp2%22%3A%22S4I1wxc_... |
864 KB 111 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
aura_prod.js
www.santanderonetrade.com/s/sfsites/auraFW/javascript/dDIdorNC3N22LalQ5i3slQ/ |
673 KB 213 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.js
www.santanderonetrade.com/s/sfsites/l/%7B%22mode%22%3A%22PROD%22%2C%22app%22%3A%22siteforce%3AloginApp2%22%2C%22serializationVersion%22%3A%221-1.7.10-228.5-b%22%2C%22split%22%3A%22f%22%2C%22loaded%... |
2 MB 358 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
d747de1bf7b1000a_complete.js
js-cdn.dynatrace.com/jstag/148709fdc4b/bf99314cet/ |
258 KB 96 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fonts.css
www.santanderonetrade.com/s/sfsites/runtimedownload/ |
0 361 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
resources.js
www.santanderonetrade.com/s/sfsites/l/%7B%22mode%22%3A%22PROD%22%2C%22app%22%3A%22siteforce%3AloginApp2%22%2C%22fwuid%22%3A%22dDIdorNC3N22LalQ5i3slQ%22%2C%22loaded%22%3A%7B%22APPLICATION%40markup%3... |
2 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.js
www.santanderonetrade.com/s/sfsites/l/%7B%22mode%22%3A%22PROD%22%2C%22app%22%3A%22siteforce%3AloginApp2%22%2C%22fwuid%22%3A%22dDIdorNC3N22LalQ5i3slQ%22%2C%22loaded%22%3A%7B%22APPLICATION%40markup%3... |
34 KB 10 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
bf
bf99314cet.bf.dynatrace.com/ |
785 B 926 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ruxitagent_D_10205201116183137.js
js-cdn.dynatrace.com/jstag/148709fdc4b/ |
37 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
aura
www.santanderonetrade.com/s/sfsites/ |
82 KB 15 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.santanderonetrade.com/s/login/ |
20 B 20 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET BLOB |
9fb27bf7-0062-410b-b71e-1664f42820c0
https://www.santanderonetrade.com/ |
36 KB 0 |
Other
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
aura
www.santanderonetrade.com/s/sfsites/ |
5 KB 3 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
aura
www.santanderonetrade.com/s/sfsites/ |
1 KB 1 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
bf
bf99314cet.bf.dynatrace.com/ |
268 B 408 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
aura
www.santanderonetrade.com/s/sfsites/ |
3 KB 1 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
aura
www.santanderonetrade.com/s/sfsites/ |
1 KB 969 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
SantanderTextW05-Regular.woff2
www.santanderonetrade.com/s/sfsites/c/resource/Santander_Fonts/Fonts/ |
46 KB 46 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
symbols.svg
www.santanderonetrade.com/_slds/icons/utility-sprite/svg/ |
257 KB 74 KB |
Other
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
servlet.ImageServer
www.santanderonetrade.com/servlet/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
bf
bf99314cet.bf.dynatrace.com/ |
0 0 |
Other
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
bf
bf99314cet.bf.dynatrace.com/ |
268 B 408 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
bf
bf99314cet.bf.dynatrace.com/ |
268 B 408 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
bf
bf99314cet.bf.dynatrace.com/ |
268 B 408 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
bf
bf99314cet.bf.dynatrace.com/ |
268 B 408 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Santander (Banking)21 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| dT_ object| dtrum object| picassoSPA string| comm__attrVariationKey number| pageStartTime object| Aura object| AuraLocker object| AuraLockerDisabled object| $A object| aura function| DOMPurify function| Router9 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.santanderonetrade.com/ | Name: dtPC Value: -17$185552072_306h-vVTRKVACRNBJMJEVPAUECWMHRWRRPOJSA-0e1 |
|
.santanderonetrade.com/ | Name: rxvt Value: 1608187352236|1608185552079 |
|
www.santanderonetrade.com/ | Name: force-stream Value: !Bn5/euO9R/LQpLKmdG81JA+TY8SBlPOAkXd8qJFV27xuQot3DBVcrfl9dNmzjpjpVqAihnjsjCSmlvk= |
|
www.santanderonetrade.com/ | Name: sfdc-stream Value: !Bn5/euO9R/LQpLKmdG81JA+TY8SBlPOAkXd8qJFV27xuQot3DBVcrfl9dNmzjpjpVqAihnjsjCSmlvk= |
|
.santanderonetrade.com/ | Name: rxVisitor Value: 1608185552077DJC9TECOTRARVKPA4QB7MHQFROKL2GJJ |
|
.santanderonetrade.com/ | Name: dtCookie Value: -17$STVS20LNAQMBDKNTCTFNE8VQN7ECA8VD |
|
.santanderonetrade.com/ | Name: dtSa Value: - |
|
www.santanderonetrade.com/ | Name: force-proxy-stream Value: !EbK0aPQ4oTXdGexl4K2SMvDB8O3nAqxaUY1WBJ20nK7zbn9sMzxCKu+dZlyEB/k9cZ9VahcUilCRDec= |
|
.www.santanderonetrade.com/s | Name: renderCtx Value: %7B%22pageId%22%3A%2248b2f8db-02e5-4417-82bb-17d96794a4a7%22%2C%22schema%22%3A%22Published%22%2C%22viewType%22%3A%22Published%22%2C%22brandingSetId%22%3A%2239e35d4f-2f1a-4a7c-8f3c-dafee37dd02f%22%2C%22audienceIds%22%3A%22%22%7D |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | upgrade-insecure-requests |
Strict-Transport-Security | max-age=31536004; includeSubDomains |
X-Content-Type-Options | nosniff |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bf99314cet.bf.dynatrace.com
js-cdn.dynatrace.com
www.santanderonetrade.com
2a02:26f0:eb::5f64:b508
34.247.72.187
65.9.68.91
02bcdea7f03385ad42670933e4f256ed810d06d1c4079c7cd381917edc84f304
0b9f17cfbf718f864d9f7e383a2d1d47d73245c7f9b9b9dc53b1aa4ddad53051
1d36194ca20e55bcfb56d48927e20deef4f62716dd418549d199090ad096514c
1e2a784490a9f511328705c86b45b6c74e83bfe7a44cc12e99b19b0245e0f252
2309b6ca0663d81e74bbd4f08f05f98fb4c471fcd0eb1f22dd1911e3c7839ed6
4140292d2f6170694fba8a847fbd4e9def89c105a0344b3de8f4bb380cd86dc4
45161016362e5ff348d44d434476df1632a544e4901574fe8b89cc96fc22f987
45a41d40c24babc4722ed6287f59ed6d1f1b573d52ce9154750069ce935bb986
49e9f18627998c24e0b73e38f0b1dcc8f28f6e9c786f56f6a1c5e0a86573fcf4
6f2fb2b5373270f2377631ce83257691fe826c61245f60f1613e3e5f613ec685
83fc2ade0d02698b2f7b3691099402a11f75d0d7e6e62b2ceaab0f98bf9961bd
8d47063b383b783842eb51a33ac1bf05b087ad432c4cebf33736fd5edc2702f6
9f9d9249026b17f05215bf56df37bc025fa8e9cb0c7f261b6db3f2c4e38c34e0
9fb6b61c7bba3878dcf5fa28b8a6844fb0c241c3098ce041d29eff572083dc85
ab1a56e8eb9d0d40a065c28c060c467ee4db764c2716c002e85635dd539447c7
ad8d2f6705970aecee5c3c33c4a183af07db19acf5062d9c8f246ecb3e40db54
b0a473d508cf54d93dc38f50de5bf18e01b82c74f5b0fc3671d58712b3948ff7
b238b986ac3d70d353df37c43cc996108233adb36b40115f0125d784a1f0ef5a
b38ebf495f8fd6eb28bd2a3ca8488a6f6777444b5aca4836a290d9d2f62077be
d9b7fff665a1efe85259bad2f12398d433af78ecb1a2626863c9444ec5828ae4
df7abc314cf6e0380973cea5ad3cd7a4536b820d974162c9d94f534f539eef0b
e304659135051f034917fb370aa0189c24dfcd1d2eb754a6b2f77316219c4d82
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fd9d5607922b0ca5fa2e248a3dc0567554df073ece572bb7388583df77b327b5
fe33088be36dbbaad6dc4d11a0401f94151bc1b9484a89c39fb613f3a90dfa9d