urlscan.io logo urlscan.io
SecurityTrails logo

security-device-removal.com Open in urlscan Pro
91.215.85.14  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://security-device-removal.com/
Effective URL: https://security-device-removal.com/pages
Submission Tags: @ecarlesi threat #phishing #bancosantander Search All
Submission: On August 26 via api from FR — Scanned from FR
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 4 countries across 5 domains to perform 14 HTTP transactions. The main IP is 91.215.85.14, located in Russian Federation and belongs to PROSPERO-AS, RU. The main domain is security-device-removal.com.
TLS certificate: Issued by R3 on August 25th 2023. Valid for: 3 months.
This is the only time security-device-removal.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Santander (Banking)

Domain & IP information

IP Address AS Autonomous System
1 8 91.215.85.14 200593 (PROSPERO-AS)
1 2001:4de0:ac1... 20446 (STACKPATH...)
3 15.204.22.185 16276 (OVH)
2 193.127.210.129 2134 (GSVNET-AS...)
1 44.217.188.90 14618 (AMAZON-AES)
14 5
8    91.215.85.14 (Russian Federation)

ASN200593 (PROSPERO-AS, RU)
security-device-removal.com
1    2001:4de0:ac18::1:a:1b (Netherlands)

ASN20446 (STACKPATH-CDN, US)
code.jquery.com
3    15.204.22.185 (Hillsboro, United States)

ASN16276 (OVH, FR)
PTR: ip185.ip-15-204-22.us
db.onlinewebfonts.com
2    193.127.210.129 (Milton Keynes, United Kingdom)

ASN2134 (GSVNET-AS GS Virtual Network Produban, ES)
retail.santander.co.uk
1    44.217.188.90 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-217-188-90.compute-1.amazonaws.com
events.splash-screen.net
Apex Domain
Subdomains		 Transfer
8 security-device-removal.com
security-device-removal.com
92 KB
3 onlinewebfonts.com
db.onlinewebfonts.com — Cisco Umbrella Rank: 35524
8 KB
2 santander.co.uk
retail.santander.co.uk — Cisco Umbrella Rank: 156962
81 KB
1 splash-screen.net
events.splash-screen.net — Cisco Umbrella Rank: 52299
103 B
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 736
30 KB
14 5
Domain Requested by
8 security-device-removal.com 1 redirects security-device-removal.com
3 db.onlinewebfonts.com security-device-removal.com
db.onlinewebfonts.com
2 retail.santander.co.uk security-device-removal.com
1 events.splash-screen.net security-device-removal.com
1 code.jquery.com security-device-removal.com
14 5

This site contains no links.

Subject Issuer Validity Valid
*.security-device-removal.com
R3		 2023-08-25 -
2023-11-23		 3 months crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA		 2023-07-11 -
2024-07-14		 a year crt.sh
onlinewebfonts.com
Sectigo RSA Domain Validation Secure Server CA		 2022-11-07 -
2023-12-07		 a year crt.sh
retail.santander.co.uk
Entrust Certification Authority - L1M		 2023-03-21 -
2024-04-04		 a year crt.sh
*.splash-screen.net
DigiCert TLS RSA SHA256 2020 CA1		 2023-02-06 -
2024-03-08		 a year crt.sh

This page contains 1 frames:

Primary Page: https://security-device-removal.com/pages
Frame ID: 0BD5C47FFAB44C1B726C2C5BF5EF8EF5
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Personal Online Banking: Log on or sign upBack ButtonSearch IconFilter IconArrow

Page URL History Show full URLs

  1. https://security-device-removal.com/ HTTP 302
    https://security-device-removal.com/pages Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

14
Requests

100 %
HTTPS

20 %
IPv6

5
Domains

5
Subdomains

5
IPs

4
Countries

210 kB
Transfer

618 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://security-device-removal.com/ HTTP 302
    https://security-device-removal.com/pages Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request pages
security-device-removal.com/
Redirect Chain
  • https://security-device-removal.com/
  • https://security-device-removal.com/pages
150 KB
28 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://security-device-removal.com/pages
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
91.215.85.14 , Russian Federation, ASN200593 (PROSPERO-AS, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
df81684085427e3c087ac1842b28f267416df6b37d56218ba5ebc2a79936e6e0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language
fr-FR,fr;q=0.9

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
br
content-type
text/html; charset=UTF-8
date
Sat, 26 Aug 2023 07:54:37 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
LiteSpeed
vary
Accept-Encoding

Redirect headers

alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
cache-control
no-cache, no-store, must-revalidate, max-age=0
content-length
0
content-type
text/html; charset=UTF-8
date
Sat, 26 Aug 2023 07:54:37 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
location
https://security-device-removal.com/pages
pragma
no-cache
server
LiteSpeed
jquery-3.1.1.min.js
code.jquery.com/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.1.1.min.js
Requested by
Host: security-device-removal.com
URL: https://security-device-removal.com/pages
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac18::1:a:1b , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software
nginx /
Resource Hash
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

Request headers

Referer
https://security-device-removal.com/
Origin
https://security-device-removal.com
accept-language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Sat, 26 Aug 2023 07:54:37 GMT
content-encoding
gzip
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
server
nginx
etag
W/"28feccc0-152b5"
surrogate-control
max-age=315360000;hw-h2proxy
vary
Accept-Encoding
x-hw
1693036477.cdn4-pxy027-cdg02.pa1.evs,1693036477.cds218.pa1.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000,public
accept-ranges
bytes
content-length
30070
058d42bfae0ddfbe480af070188ce3e8
db.onlinewebfonts.com/c/ 		1 KB
684 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://db.onlinewebfonts.com/c/058d42bfae0ddfbe480af070188ce3e8?family=SantanderHeadlineW05-Bold
Requested by
Host: security-device-removal.com
URL: https://security-device-removal.com/pages
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
15.204.22.185 Hillsboro, United States, ASN16276 (OVH, FR),
Reverse DNS
ip185.ip-15-204-22.us
Software
nginx /
Resource Hash
ff25bc626504d611db68db53f5629d8c7bdf35c05593fa6fa8f57dc8c22af667

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://security-device-removal.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Sat, 26 Aug 2023 07:54:32 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding, Accept-Encoding
access-control-allow-methods
GET,POST,OPTIONS
content-type
text/css;charset=UTF-8
access-control-allow-origin
*
nginx-cache
HIT
cache-control
public,max-age=86400,must-revalidate
access-control-allow-headers
X-Requested-With
dbe98f282aedd7682f9e1fac27daa2e1
db.onlinewebfonts.com/c/ 		1 KB
683 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://db.onlinewebfonts.com/c/dbe98f282aedd7682f9e1fac27daa2e1?family=Santander+Logo+Light
Requested by
Host: security-device-removal.com
URL: https://security-device-removal.com/pages
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
15.204.22.185 Hillsboro, United States, ASN16276 (OVH, FR),
Reverse DNS
ip185.ip-15-204-22.us
Software
nginx /
Resource Hash
f09b731b0543373987d2c055e8dfecb77607eb921a7489027a88417feee4c604

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://security-device-removal.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Sat, 26 Aug 2023 07:54:32 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding, Accept-Encoding
access-control-allow-methods
GET,POST,OPTIONS
content-type
text/css;charset=UTF-8
access-control-allow-origin
*
nginx-cache
HIT
cache-control
public,max-age=86400,must-revalidate
access-control-allow-headers
X-Requested-With
jquery.js
security-device-removal.com/js/cntdjs/ 		87 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://security-device-removal.com/js/cntdjs/jquery.js
Requested by
Host: security-device-removal.com
URL: https://security-device-removal.com/pages
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
91.215.85.14 , Russian Federation, ASN200593 (PROSPERO-AS, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://security-device-removal.com/pages
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Sat, 26 Aug 2023 07:54:37 GMT
content-encoding
br
last-modified
Thu, 02 Jun 2022 03:14:08 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length
30267
expires
Sat, 02 Sep 2023 07:54:37 GMT
jquery.mask.js
security-device-removal.com/js/cntdjs/ 		23 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://security-device-removal.com/js/cntdjs/jquery.mask.js
Requested by
Host: security-device-removal.com
URL: https://security-device-removal.com/pages
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
91.215.85.14 , Russian Federation, ASN200593 (PROSPERO-AS, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
a199620fe981df00a825f78761d3f7c8870f8117daa4a890e08018dec386dae8

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://security-device-removal.com/pages
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Sat, 26 Aug 2023 07:54:37 GMT
content-encoding
br
last-modified
Thu, 02 Jun 2022 03:14:08 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
5583
expires
Sat, 02 Sep 2023 07:54:37 GMT
cntd.js
security-device-removal.com/js/cntdjs/ 		3 KB
911 B 		Script
General
Check archive.org
Download Go to
Full URL
https://security-device-removal.com/js/cntdjs/cntd.js
Requested by
Host: security-device-removal.com
URL: https://security-device-removal.com/pages
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
91.215.85.14 , Russian Federation, ASN200593 (PROSPERO-AS, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
5b056148977cddad1d04190e8588f71549f5fbce2c8504fd0a52699a451896ca

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://security-device-removal.com/pages
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Sat, 26 Aug 2023 07:54:37 GMT
content-encoding
br
last-modified
Thu, 02 Jun 2022 03:14:08 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
889
expires
Sat, 02 Sep 2023 07:54:37 GMT
loading.js
security-device-removal.com/js/shared/ 		2 KB
662 B 		Script
General
Check archive.org
Download Go to
Full URL
https://security-device-removal.com/js/shared/loading.js
Requested by
Host: security-device-removal.com
URL: https://security-device-removal.com/pages
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
91.215.85.14 , Russian Federation, ASN200593 (PROSPERO-AS, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
4bdc871a71df801aa86926434d6fbed9744ec4757af4e9d6d40978724ea59134

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://security-device-removal.com/pages
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Sat, 26 Aug 2023 07:54:37 GMT
content-encoding
br
last-modified
Thu, 02 Jun 2022 03:14:08 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
640
expires
Sat, 02 Sep 2023 07:54:37 GMT
online_status.js
security-device-removal.com/js/shared/ 		998 B
405 B 		Script
General
Check archive.org
Download Go to
Full URL
https://security-device-removal.com/js/shared/online_status.js
Requested by
Host: security-device-removal.com
URL: https://security-device-removal.com/pages
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
91.215.85.14 , Russian Federation, ASN200593 (PROSPERO-AS, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
e64e9d464beb9fe2717cd8bd8d093bb04d570f08a15c65f14533733904e12be7

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://security-device-removal.com/pages
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Sat, 26 Aug 2023 07:54:37 GMT
content-encoding
br
last-modified
Thu, 02 Jun 2022 03:14:08 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
383
expires
Sat, 02 Sep 2023 07:54:37 GMT
main.css
security-device-removal.com/front_end/front_end_files/ 		179 KB
26 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://security-device-removal.com/front_end/front_end_files/main.css
Requested by
Host: security-device-removal.com
URL: https://security-device-removal.com/pages
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
91.215.85.14 , Russian Federation, ASN200593 (PROSPERO-AS, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
69a6420b86cd0a04739c043b398338075c421829525da4edfb2104717aa749d9

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://security-device-removal.com/pages
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Sat, 26 Aug 2023 07:54:37 GMT
content-encoding
br
last-modified
Fri, 03 Mar 2023 16:50:08 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
26612
expires
Sat, 02 Sep 2023 07:54:37 GMT
header-logo.png
retail.santander.co.uk/olb/app/logon/access/assets/images/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://retail.santander.co.uk/olb/app/logon/access/assets/images/header-logo.png
Requested by
Host: security-device-removal.com
URL: https://security-device-removal.com/pages
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
193.127.210.129 Milton Keynes, United Kingdom, ASN2134 (GSVNET-AS GS Virtual Network Produban, ES),
Reverse DNS
Software
/
Resource Hash
f700c3638638b62b07e614c8cae5665cf4bfa956452ab4e6fea5a15965fc40f7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://security-device-removal.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Date
Sat, 26 Aug 2023 07:54:38 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Mon, 10 Jul 2023 10:56:48 GMT
ETag
"64abe3f0-aeb"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=2592000, public
Server-Timing
dtSInfo;desc="0", dtRpid;desc="17687065"
Accept-Ranges
bytes
Content-Length
2795
Expires
Mon, 25 Sep 2023 07:54:38 GMT
asset-3-3-x@2x.png
retail.santander.co.uk/olb/app/logon/access/assets/images/ 		77 KB
78 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://retail.santander.co.uk/olb/app/logon/access/assets/images/asset-3-3-x@2x.png
Requested by
Host: security-device-removal.com
URL: https://security-device-removal.com/pages
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
193.127.210.129 Milton Keynes, United Kingdom, ASN2134 (GSVNET-AS GS Virtual Network Produban, ES),
Reverse DNS
Software
/
Resource Hash
08f86c6496d80636195dd2e2037f5c141f65ed6b969514531e61512ea239c5d8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://security-device-removal.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Date
Sat, 26 Aug 2023 07:54:38 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Mon, 10 Jul 2023 10:56:48 GMT
ETag
"64abe3f0-133b2"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=2592000, public
Server-Timing
dtSInfo;desc="0", dtRpid;desc="-747317770"
Accept-Ranges
bytes
Content-Length
78770
Expires
Mon, 25 Sep 2023 07:54:38 GMT
/
events.splash-screen.net/splash_events/ 		0
103 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://events.splash-screen.net/splash_events/?business=rcing_santanderuk&application=santanderuk_personal_20140304&key=97123&event=close&sub_event=close_button
Requested by
Host: security-device-removal.com
URL: https://security-device-removal.com/pages
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
44.217.188.90 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-44-217-188-90.compute-1.amazonaws.com
Software
haile /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://security-device-removal.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Connection
keep-alive
Date
Sat, 26 Aug 2023 07:54:39 GMT
Server
haile
dbe98f282aedd7682f9e1fac27daa2e1.woff2
db.onlinewebfonts.com/t/ 		6 KB
6 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://db.onlinewebfonts.com/t/dbe98f282aedd7682f9e1fac27daa2e1.woff2
Requested by
Host: db.onlinewebfonts.com
URL: https://db.onlinewebfonts.com/c/dbe98f282aedd7682f9e1fac27daa2e1?family=Santander+Logo+Light
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
15.204.22.185 Hillsboro, United States, ASN16276 (OVH, FR),
Reverse DNS
ip185.ip-15-204-22.us
Software
nginx /
Resource Hash
8fa111129c20b326d73332e5702145876f59aadf230fe2f7fabbbe3836599400

Request headers

Referer
https://db.onlinewebfonts.com/c/dbe98f282aedd7682f9e1fac27daa2e1?family=Santander+Logo+Light
Origin
https://security-device-removal.com
accept-language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date
Sat, 26 Aug 2023 07:54:33 GMT
server
nginx
access-control-allow-methods
GET,POST,OPTIONS
content-type
application/x-font-woff
access-control-allow-origin
*
nginx-cache
HIT
cache-control
public,max-age=86400,must-revalidate
access-control-allow-headers
X-Requested-With
content-length
6432

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Santander (Banking)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| documentPictureInPicture function| $ function| jQuery string| urlroot string| uniqueid object| submitButton boolean| can_proceed_pid boolean| can_proceed_snum function| filter_username object| controller string| url

1 Cookies

Domain/Path Name / Value
security-device-removal.com/ Name: PHPSESSID
Value: e2af1ce7bf6801e89aef8aada985c085

1 Console Messages

Source Level URL
Text
rendering warning URL: https://security-device-removal.com/pages(Line 33)
Message:
The key "inital-scale" is not recognized and ignored.