www.barclays.payee-authid.com
Open in
urlscan Pro
8.210.42.17
Malicious Activity!
Public Scan
Submission Tags: phishing spamreports malicious Search All
Submission: On April 15 via api from BG
Summary
This is the only time www.barclays.payee-authid.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Barclays (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
5 | 8.210.42.17 8.210.42.17 | 45102 (CNNIC-ALI...) (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co.) | |
2 | 104.109.77.38 104.109.77.38 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
17 | 104.109.91.58 104.109.91.58 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
1 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:1b | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
28 | 5 |
ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN)
www.barclays.payee-authid.com |
ASN16625 (AKAMAI-AS, US)
PTR: a104-109-77-38.deploy.static.akamaitechnologies.com
tags.tiqcdn.com |
ASN16625 (AKAMAI-AS, US)
PTR: a104-109-91-58.deploy.static.akamaitechnologies.com
bank.barclays.co.uk |
Apex Domain Subdomains |
Transfer | |
---|---|---|
17 |
barclays.co.uk
bank.barclays.co.uk |
588 KB |
5 |
payee-authid.com
www.barclays.payee-authid.com |
13 KB |
2 |
tiqcdn.com
tags.tiqcdn.com |
29 KB |
1 |
jquery.com
code.jquery.com |
83 KB |
28 | 4 |
Domain | Requested by | |
---|---|---|
17 | bank.barclays.co.uk |
www.barclays.payee-authid.com
bank.barclays.co.uk |
5 | www.barclays.payee-authid.com |
www.barclays.payee-authid.com
code.jquery.com |
2 | tags.tiqcdn.com |
www.barclays.payee-authid.com
tags.tiqcdn.com |
1 | code.jquery.com |
www.barclays.payee-authid.com
|
28 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.barclays.co.uk |
status.uk.barclays |
www.bsigroup.com |
www.iso.org |
www.fscs.org.uk |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.tiqcdn.com DigiCert SHA2 Secure Server CA |
2020-03-16 - 2021-06-15 |
a year | crt.sh |
bank.barclays.co.uk Entrust Certification Authority - L1M |
2021-01-08 - 2021-09-10 |
8 months | crt.sh |
jquery.org Sectigo RSA Domain Validation Secure Server CA |
2020-10-06 - 2021-10-16 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://www.barclays.payee-authid.com/
Frame ID: 8A6429A486D5A9AA3E11563F6B3DB7D4
Requests: 30 HTTP requests in this frame
Screenshot
Detected technologies
Nginx (Web Servers) ExpandDetected patterns
- headers server /nginx(?:\/([\d.]+))?/i
AngularJS (JavaScript Frameworks) Expand
Detected patterns
- script /angular.*\.js/i
SiteCatalyst (Analytics) Expand
Detected patterns
- script /\/s[_-]code.*\.js/i
Tealium (Advertising Networks) Expand
Detected patterns
- script /^(?:https?:)?\/\/tags\.tiqcdn\.com\//i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery[.-]([\d.]*\d)[^/]*\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
11 Outgoing links
These are links going to different origins than the main page.
Title: Secure
Search URL Search Domain Scan URL
Title: status.uk.barclays
Search URL Search Domain Scan URL
Title: find out how
Search URL Search Domain Scan URL
Title: www.barclays.co.uk/help/mobile-banking/pinsentry/info/
Search URL Search Domain Scan URL
Title: Contact us
Search URL Search Domain Scan URL
Title: Accessibility
Search URL Search Domain Scan URL
Title: See our cookies policy
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
28 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Cookie set
/
www.barclays.payee-authid.com/ |
69 KB 12 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
utag.js
tags.tiqcdn.com/utag/barclaysuk/barclays-olb/prod/ |
160 KB 29 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bdlLogin-dss-jquery-libraries.min.js
www.barclays.payee-authid.com/authlogin/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
polyfill.wp.js
bank.barclays.co.uk//authlogin/lib/ |
98 KB 98 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
angular.min.js
bank.barclays.co.uk//js/myBarclays/vendor/angular/ |
105 KB 39 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
angular-route.min.js
bank.barclays.co.uk//js/myBarclays/vendor/angular/ |
4 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
angular-sanitize.min.js
bank.barclays.co.uk//js/myBarclays/vendor/angular/ |
4 KB 3 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bdlLogin-rolb-dss.min.js
bank.barclays.co.uk//authlogin/ |
254 KB 66 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bdlLogin-libraries.min.js
bank.barclays.co.uk//authlogin/ |
71 KB 27 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bdlLogin-rolb-app.min.js
bank.barclays.co.uk//authlogin/ |
265 KB 74 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
s_codecookies.js
bank.barclays.co.uk//js/sitecatalyst/ |
51 KB 20 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6bb5a42d.min.js
bank.barclays.co.uk//js/bc/2.8.1/ |
340 KB 88 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.5.1.js
code.jquery.com/ |
281 KB 83 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rolb-theme-2-0.css
bank.barclays.co.uk/authlogin/css/ |
333 KB 69 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
authlogin-bdl.min.css
bank.barclays.co.uk/authlogin/css/ |
45 KB 45 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1321217916907-bsikitemarklogo.png
bank.barclays.co.uk/OLB/A/Content/Images/ |
13 KB 14 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1321217916492-iso27001footer.JPG
bank.barclays.co.uk/OLB/A/Content/Images/ |
24 KB 24 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1321217918424-cyberfooter.jpg
bank.barclays.co.uk/OLB/A/Content/Images/ |
9 KB 9 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login-fscs.png
bank.barclays.co.uk/OLB/A/Content/Images/ |
5 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bdlLogin.bootstrap.min.js
bank.barclays.co.uk/authlogin/ |
19 KB 4 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Padlock_icon.svg
bank.barclays.co.uk/authlogin/img/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
expert-sans-regular.woff
bank.barclays.co.uk/authlogin/css/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
expert-sans-light.woff
bank.barclays.co.uk/authlogin/css/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET BLOB |
fefedb2e-6c98-45a7-9579-01d546569e0b
http://www.barclays.payee-authid.com/ |
139 KB 0 |
Other
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
utag.v.js
tags.tiqcdn.com/utag/tiqapp/ |
2 B 356 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
activity.php
www.barclays.payee-authid.com/files/ |
18 B 364 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
activity.php
www.barclays.payee-authid.com/files/ |
18 B 364 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
activity.php
www.barclays.payee-authid.com/files/ |
18 B 364 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- bank.barclays.co.uk
- URL
- https://bank.barclays.co.uk/authlogin/css/fonts/expert-sans-regular.woff
- Domain
- bank.barclays.co.uk
- URL
- https://bank.barclays.co.uk/authlogin/css/fonts/expert-sans-light.woff
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Barclays (Banking)114 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated boolean| utag_condload object| utag boolean| __tealium_twc_switch object| utag_cfg_ovrd object| __core-js_shared__ object| core object| global object| System function| asap function| Observable function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill object| angular number| ng339 function| _ function| getElementsByClassName function| getTextContent function| scFixed function| scFixed1Tag function| scAppendWholeTag function| scLowRankTag function| scProductsTag function| scSetLinkNameTag function| scCombinedP123 function| scRemap function| tagPageView function| tagAjaxContent function| tagQueryContents function| setFromClickTagsFTB function| scLinkTrack function| scLinkTrackError function| dcsMultiTrack function| scMeta function| scSetInitial function| scSetDerived function| isLoginPage function| isHomePage function| scSetHelpCardButtons function| scCleanUpEvents function| scLoginPagesTracking function| scCleanUp function| scSetValidationErrorMessage function| fireLoadEvent function| scSetErrorMessage function| scSetErrorServiceMessage function| scSetImpressions function| scSetLOGIN_METHOD function| scSetLOGIN_MECHANISM function| scSetLoginEvents function| scSetDeepLink function| scSetdcsuri function| scSetProducts function| scSetView function| getProp34 function| scSetPurchaseTracking function| scSetActivityTracking function| scSetLoginReg function| scSetPageName function| isMultipleSavedUsers function| scSetEvents function| scSetDcsvid function| scBarclaysCookieConsent function| scMapTag function| scSetTag function| scAddTag function| scUpdateLinkTrack function| scSaveBasePageName function| scRestoreBasePageName function| scSaveTakeoverPageName function| scRestoreTakeoverPageName object| AppName object| authloginDigitalData string| s_account object| dcs2sc string| scBasePageName string| scTakeoverPageName object| _self object| Prism undefined| WebAnalytics object| s function| s_doPlugins string| s_code undefined| s_objectID function| s_gi function| s_giqf string| s_an function| s_sp function| s_jn function| s_rep function| s_d function| s_fe function| s_fa function| s_ft object| s_c_il number| s_c_in number| s_giq object| cdApi function| $ function| jQuery boolean| ie8 object| browser_detect function| mboxDefine function| mboxUpdate string| pathref object| dataLayer number| interval function| heartbeat4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.payee-authid.com/ | Name: utag_main Value: v_id:0178d3c3d01f001fd5e017784e2000072002506a00b08$_sn:1$_se:1$_ss:1$_st:1618462328672$ses_id:1618460528672%3Bexp-session$_pn:1%3Bexp-session |
|
.payee-authid.com/ | Name: bmuid Value: 1618460529724-A30BB171-1AAF-4BF3-AD93-9E57E7B17155 |
|
.payee-authid.com/ | Name: cdContextId Value: 1 |
|
www.barclays.payee-authid.com/ | Name: PHPSESSID Value: ier6ijkhv7sjp4k3s8c6u96t36 |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bank.barclays.co.uk
code.jquery.com
tags.tiqcdn.com
www.barclays.payee-authid.com
bank.barclays.co.uk
104.109.77.38
104.109.91.58
2001:4de0:ac18::1:a:1b
8.210.42.17
02e9e14e36ad05a2a528e81898868b7c9fb738980d111599f4460dc7926aa1b0
03c2526a71f8b178491bca3226f69d72a28aa606133527c00b28adab490f940d
073f5b7ffebc61098e2b649f2067252032ff1865167948af2a8847f5d8f760f6
1d3fef663505e5ce8eccf28b01bb423260210ff6e57c33853adf372194c3f593
20318e023853ac4d3e1f231b0532de4c39d83c629a4155756c021e57825dc884
225667650d0be401e4cb148aa2dea5ad695c19563d2f94cfa20aa7082c5c966a
23258114961c94563c3e7df66f059d487995e01f4ce666f2e5b84f1c499e63cc
2aa89b0d3ed189360406952265076a3f79ea08b045f2e07d7d71e3c38982533e
2d97b2dc8d0cbcf5fda0b1f03c223735e5d46f9e7bc333f48f9930c3a364133f
416a3b2c3bf16d64f6b5b6d0f7b079df2267614dd6847fc2f3271b4409233c37
4443260f173a9227f2afb899b9e4337b364bcf78df56c322d6c19e4a6edf01d6
52aa6e020c0bb612dd9221d801a3ebda86836e047dbd30e21069248669061cbb
74189db3aed3aaebdb390cd7eb17a825f9ff32a0f65a0ae48dea3cfb80515be5
90326fd2ae35b37049ca9b624acb2b698be96a509f3619cf647d686433eaaa15
91a06213190743f440aa3411f1393afaf3de8b3b6309d6677fb7680248f09e91
94f9149f1315d2a1b9f44a7fd18360f4ef65b7255fbde2d926619c00b37fcbe9
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
b173ff6e97748a8a4e079bf7afa965e4d264fa43a351c4a0bf2c130bc65b4366
c7588e66ab3dfc34b4beda8e07aa630e5a764a001d7568244ef963c3620f3365
e111be4c24fc0743ca7eb1c4873a64bb234135b9bea86cabd922a5caabb6c9c6
e7ae57b0d2e853b851ade7878dce6dfe2f64cbbee88273d5b68049b1dc939d72
ed6604f7293bcfe87ee03795e418c40cb40a96444a320d45bb97dfdcf40a14b8
effa2f551ae3f572384002e36028aa1e85544462f42c28065731284e8f81bfcd
f8ea0e980b8bdca260f9f81d0e98360c3080fdc7fd3992cf611e05701e2e8a36
fca63a7a3eb5d2b14c03d129964c75182fbedf12ac40f123ea52daa277d5f4a2