okriyg.ml
Open in
urlscan Pro
216.10.249.27
Malicious Activity!
Public Scan
URL:
http://okriyg.ml/page1.php?entity=1875829
Submission: On September 07 via manual from IN — Scanned from DE
Submission: On September 07 via manual from IN — Scanned from DE
Summary
This website contacted 2 IPs
in 1 countries
across 1 domains to perform 2 HTTP transactions.
The main IP is 216.10.249.27, located in
India and
belongs to PUBLIC-DOMAIN-REGISTRY, US.
The main domain is okriyg.ml.
This is the only time okriyg.ml was scanned on urlscan.io!
This is the only time okriyg.ml was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: National Bank of Greece (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 2 | 216.10.249.27 216.10.249.27 | 394695 (PUBLIC-DO...) (PUBLIC-DOMAIN-REGISTRY) | |
| 2 | 2 |
2
216.10.249.27
(India)
ASN394695 (PUBLIC-DOMAIN-REGISTRY, US)
PTR: 216-10-249-27.webhostbox.net
ASN394695 (PUBLIC-DOMAIN-REGISTRY, US)
PTR: 216-10-249-27.webhostbox.net
| okriyg.ml |
| Domain | Requested by | |
|---|---|---|
| 2 | okriyg.ml |
okriyg.ml
|
| 2 | 1 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| ibank.nbg.gr |
| www.facebook.com |
| twitter.com |
| www.youtube.com |
| www.linkedin.com |
| www.nbg.gr |
| Subject Issuer | Validity | Valid |
|---|
This page contains 1 frames:
Primary Page:
http://okriyg.ml/page1.php?entity=1875829
Frame ID: 0338080C74D719ECA9E1D421F4F09D83
Requests: 19 HTTP requests in this frame
Screenshot
Page Title
NBG i-bankDetected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- \.php(?:$|\?)
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
9 Outgoing links
These are links going to different origins than the main page.
URL: https://ibank.nbg.gr/identity/faqs
Title: Συχνές ερωτήσεις
Title: Συχνές ερωτήσεις
Search URL Search Domain Scan URL
URL: https://ibank.nbg.gr/identity/security-information
Title: Συμβουλές ασφαλείας
Title: Συμβουλές ασφαλείας
Search URL Search Domain Scan URL
URL: https://www.facebook.com/ibanknbg
Search URL Search Domain Scan URL
URL: https://twitter.com/NationalBankGR
Search URL Search Domain Scan URL
URL: https://www.youtube.com/channel/UCAwPZIUpdP3aIQlfw4bETLQ
Search URL Search Domain Scan URL
URL: https://www.linkedin.com/company/national-bank-of-greece/
Search URL Search Domain Scan URL
URL: https://www.nbg.gr/el/contact/contact-form
Search URL Search Domain Scan URL
URL: https://www.nbg.gr/Style%20Library/ReusableContent/privacy_statement.pdf
Title: Προστασία Δεδομένων Προσωπικού Χαρακτήρα
Title: Προστασία Δεδομένων Προσωπικού Χαρακτήρα
Search URL Search Domain Scan URL
URL: https://ibank.nbg.gr/identity/browser-compatibility
Title: Συμβατότητα με browsers
Title: Συμβατότητα με browsers
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
2 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
page1.php
okriyg.ml/ |
773 KB 774 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
87 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
87 KB 87 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
26 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
37 B 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-1.10.2.min.js.t%C3%A9l%C3%A9charger
okriyg.ml/page1_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
792 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
92 KB 92 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
92 KB 92 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
93 KB 93 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
10 KB 10 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: National Bank of Greece (Banking)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch object| navigation function| noBack0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
okriyg.ml
216.10.249.27
10a055669b8d5c8b78150ae42e2326b7afa03f1d72946e42f3f2c26dd930cf90
1615a6f2e08b5edf2b9756ce02bf0e4be6b83860951c4beb9f1b4c0c39886be1
161761d367e7686d40033c1a0daeb88006e9e90b676c3e1368362748a2791fda
3e58030714e1fb747fe8762143cd2683e7e5857072762dec1d6f6ace912e44f4
657bea5fc93d3f34725e07ac72fd20201673054ebe4e88507efee5b8331d0305
724be1d544d3f4044e97e8e515f23c0f33f08e96e421021c6729947e62f10642
7a95f0a36d31f363f9789ef519f3c11b63b5ae3dc51d0a26bced8af0c1bd001d
7eaddeb2eaff03e45ce46c2b46ebce3739fa54c7ccad58a640ca4f819eac5ef2
909457e7d2ab71d52c2fa3386917fee5031be62e179b01804940a6cc9f5d61ac
91dc715405d0bb25103890b512621749faeacf1fb13299fbda4eac81f15e7cab
9ffdc3a68b780337a39d808139258907be67d951cc439a149443e4da7b36129e
a2f2447ea2c696232412fb46b12c8344dc93740b712a8689d324031e0428beb2
ab9872644e58c312c6c45df79fd68e005b03423385801e0689d96cadbd0620bb
b6a641e96d081785173e64c24b36a0b3828c2b4ca65c82b872edcd0a5a3eb4b3
b9e0f337b1ab2be7a2461abcd17a50b5ac18c4a1c5b9b14cc7005d08df57b8dc
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
d01323b878d66d88ef695648887461a1f3843853b8afea91f121483a0512f34d
ebbf0ddb0366e6ef138fbce1fb322698bd40a3db4317bfb52da1744a646f9d59