nbg-main.com
Open in
urlscan Pro
188.114.97.3
Malicious Activity!
Public Scan
Effective URL: https://nbg-main.com/
Submission Tags: @ecarlesi threat phishing Search All
Submission: On April 01 via api from IT — Scanned from NL
Summary
TLS certificate: Issued by GTS CA 1P5 on March 31st 2024. Valid for: 3 months.
This is the only time nbg-main.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: National Bank of Greece (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
20 | 188.114.97.3 188.114.97.3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2600:9000:235... 2600:9000:235a:c200:1b:ef38:3680:21 | 16509 (AMAZON-02) (AMAZON-02) | |
21 | 2 |
ASN16509 (AMAZON-02, US)
d21y75miwcfqoq.cloudfront.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
20 |
nbg-main.com
nbg-main.com |
2 MB |
1 |
cloudfront.net
d21y75miwcfqoq.cloudfront.net |
456 B |
21 | 2 |
Domain | Requested by | |
---|---|---|
20 | nbg-main.com |
nbg-main.com
|
1 | d21y75miwcfqoq.cloudfront.net |
nbg-main.com
|
21 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
nbg-main.com GTS CA 1P5 |
2024-03-31 - 2024-06-29 |
3 months | crt.sh |
*.cloudfront.net Amazon RSA 2048 M01 |
2023-10-10 - 2024-09-19 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://nbg-main.com/
Frame ID: 7ACA917C0038A1CD255F99ED27438F96
Requests: 21 HTTP requests in this frame
Screenshot
Page Title
NBG i-bankPage URL History Show full URLs
-
http://nbg-main.com/
HTTP 307
https://nbg-main.com/ Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://nbg-main.com/
HTTP 307
https://nbg-main.com/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
21 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
/
nbg-main.com/ Redirect Chain
|
12 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
style.c287c884325a9e525f01.css
nbg-main.com/css/ |
235 KB 39 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
loginGR-new.svg
nbg-main.com/images/ |
43 KB 8 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
c003107e
d21y75miwcfqoq.cloudfront.net/ |
68 B 456 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
sec-4-3.css
nbg-main.com/_sec/cp_challenge/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
login-retail-desktop.9de7030d9e97c2f1dafa8bd981c72ba9.jpg
nbg-main.com/images/ |
2 MB 2 MB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
dropdown-closed.7eebf563725be7e6cecccf566050c170.svg
nbg-main.com/images/ |
862 B 853 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
help-faq.c0c67913637dafdb685524e179ca9ede.svg
nbg-main.com/images/ |
1 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
no-password.82ced6d548accf1f29e8812417fa1f25.svg
nbg-main.com/images/ |
5 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
new-user.5a47ccd7fc95fc228bfed1915650ad55.svg
nbg-main.com/images/ |
642 B 826 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
protection.541f63e32f1a4c65920e4fb56e3591e0.svg
nbg-main.com/images/ |
699 B 852 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
fb.9e987d45b81bbbfeac09550d83c58206.svg
nbg-main.com/images/ |
525 B 795 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
twitter.3748b69b8e3744f5370f650661380124.svg
nbg-main.com/images/ |
1 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
youtube.36cdcda833e7f7fb9ee1043aba9bb8ae.svg
nbg-main.com/images/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
linkedin.ea0c1214ce7997c471b25e27b6192509.svg
nbg-main.com/images/ |
1 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
email.58449ee1338aaa0ed3b91944e1c7812c.svg
nbg-main.com/images/ |
1 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ibredesign.f0ceac6f3471ca7186d40de1d3e2f374.woff
nbg-main.com/fonts/ |
10 KB 10 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
AeonikPro-Regular.aa6b6132beeff32b423be0ef11d45b07.woff2
nbg-main.com/fonts/ |
52 KB 53 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
AeonikPro-Medium.0214496abecf780ec7172e9eece36b28.woff2
nbg-main.com/fonts/ |
54 KB 55 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
AeonikPro-Bold.4c9fd7296d2ef50427d72a79520b0d6a.woff2
nbg-main.com/fonts/ |
55 KB 56 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
nbg-main.com/ |
4 KB 2 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: National Bank of Greece (Banking)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onpagereveal0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
d21y75miwcfqoq.cloudfront.net
nbg-main.com
188.114.97.3
2600:9000:235a:c200:1b:ef38:3680:21
1615a6f2e08b5edf2b9756ce02bf0e4be6b83860951c4beb9f1b4c0c39886be1
26bcacbf03755770f640ef57654f59d119aecd24860d21c41f1ee57db203ebd8
2a181aa84942db7535f044c467c4dd9ef86a5c59e3ace707a5a700eb20172cb2
34f55023ae3af8a0a85d23e9fff5fa80f7ea33273667787a4da626a38a47d393
45ba02e75722d666067104c10acfb0a23d364f9f79bff657d26a772119b7b9d0
4a470b7f273906c503b0315b232fe0762762ea864ee535f6ed0e951415d69660
4f1ad7342c899e6146ba7ea2650a7c0d243e84e69c46ddfea61a14566fa2fd55
6300089b128e1c2e19783a909294bcb9f49a62f18e9198a4e8e4aa555d841bdd
63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058
695afd49dec62f80c45ac5a74daeb40b57fe18ef5e9a4a1bccec6d8bd782b0c4
76f52638b35495388469c5958b51673d8198f199de5d3c42a048978c1bd967c4
7eaddeb2eaff03e45ce46c2b46ebce3739fa54c7ccad58a640ca4f819eac5ef2
92cbe3c588262ee4c4c375779391a5983c840095470e19b5ea0ac9712b2576ab
bc8aedc111df6dadc3cebb83a81f4b09f3c792bb9b2857d263fa05da2c37307c
c504b326034423755e12d3ead5db24a607be40fdceeb030d03b805d96478ed33
e14434cbd781afc0f5492f68e504fa55c01d1b4b4a9165d544554ed4b2851d6f
e41064cfc6b1bb9927df87fd5479141742f99dd3360622ab5bd75a41390d8c2b
f34de185a8c241919d600febdd931374d9d11013956dbdf16a0a0e787bd36862
f4ff06292424a8d642451e44f80bb9b11874e172da692d5f56d5bedb26f128a9
f64ea182ceba200e6875619f35437fbb7aaa838e8b30faabd37e1e63ea6e3e6e