URL: https://apply-mobile.barclaycard/
Submission Tags: @phishunt_io
Submission: On November 17 via api from ES

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 104.109.58.223, located in Netherlands and belongs to AKAMAI-ASN1, EU. The main domain is apply-mobile.barclaycard.
TLS certificate: Issued by Entrust Certification Authority - L1M on March 6th 2020. Valid for: a year.
This is the only time apply-mobile.barclaycard was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
10 104.109.58.223 20940 (AKAMAI-ASN1)
10 1
Apex Domain
Subdomains
Transfer
10 apply-mobile.barclaycard
apply-mobile.barclaycard
567 KB
10 1
Domain Requested by
10 apply-mobile.barclaycard apply-mobile.barclaycard
10 1

This site contains links to these domains. Also see Links.

Domain
www.barclaycard.co.uk
ask.barclays.co.uk
Subject Issuer Validity Valid
apply-mobile.barclaycard
Entrust Certification Authority - L1M
2020-03-06 -
2021-03-06
a year crt.sh

This page contains 1 frames:

Primary Page: https://apply-mobile.barclaycard/
Frame ID: DAD489E0F2BC899ADA808C90CF254EE5
Requests: 10 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • script /require.*\.js/i

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

567 kB
Transfer

1768 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request Cookie set /
apply-mobile.barclaycard/
1 KB
1 KB
Document
General
Full URL
https://apply-mobile.barclaycard/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.109.58.223 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a104-109-58-223.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
ef4a2d778bcf6c941a8c0c8babb524a50e1793cebee797126d7791a38aac3ed8
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Frame-Options DENY
X-Xss-Protection 1;mode=block

Request headers

Host
apply-mobile.barclaycard
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Vary
accept-encoding
Content-Encoding
gzip
Content-Type
text/html
Cache-Control
no-cache,max-age=0
Last-Modified
Wed, 28 Oct 2020 14:29:36 GMT
Content-Length
594
ETag
W/"252-5f998050"
Accept-Ranges
bytes
X-frame-options
DENY
Date
Tue, 17 Nov 2020 00:37:03 GMT
Connection
keep-alive
Set-Cookie
BIGipServerapply-mobile-gl_https_pool=1413349386.18776.0000; path=/ site-id=GLC1; SameSite=Lax; Max-Age=900; httpOnly; Secure; Path=/
X-Xss-Protection
1;mode=block
Strict-Transport-Security
max-age=63072000; includeSubDomains
barclays-base-1.0.0.min.css
apply-mobile.barclaycard/lib/themes/barclays/css/
475 KB
162 KB
Stylesheet
General
Full URL
https://apply-mobile.barclaycard/lib/themes/barclays/css/barclays-base-1.0.0.min.css
Requested by
Host: apply-mobile.barclaycard
URL: https://apply-mobile.barclaycard/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.109.58.223 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a104-109-58-223.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
01691460ee5542e414bcd0e03c1f8d3cb25563a467420f2af8c3baec0b6c2932
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Frame-Options DENY
X-Xss-Protection 1;mode=block

Request headers

Referer
https://apply-mobile.barclaycard/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 17 Nov 2020 00:37:03 GMT
Content-Encoding
gzip
Vary
accept-encoding
Last-Modified
Wed, 28 Oct 2020 14:29:36 GMT
ETag
W/"284a1-5f998050"
X-frame-options
DENY
Connection
keep-alive
Content-Type
text/css
Cache-Control
no-cache,max-age=0
Strict-Transport-Security
max-age=63072000; includeSubDomains
Accept-Ranges
bytes
Content-Length
165025
X-Xss-Protection
1;mode=block
require.js
apply-mobile.barclaycard/lib/
80 KB
19 KB
Script
General
Full URL
https://apply-mobile.barclaycard/lib/require.js
Requested by
Host: apply-mobile.barclaycard
URL: https://apply-mobile.barclaycard/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.109.58.223 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a104-109-58-223.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
6b1ad3a1bc18d2c298db6184dc1b3e4070ac3a528fe27a4504ee30d25aeefec8
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Frame-Options DENY
X-Xss-Protection 1;mode=block

Request headers

Referer
https://apply-mobile.barclaycard/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 17 Nov 2020 00:37:03 GMT
Content-Encoding
gzip
Vary
accept-encoding
Last-Modified
Wed, 28 Oct 2020 14:29:36 GMT
ETag
W/"4b99-5f998050"
X-frame-options
DENY
Connection
keep-alive
Content-Type
application/x-javascript
Cache-Control
no-cache,max-age=0
Strict-Transport-Security
max-age=63072000; includeSubDomains
Accept-Ranges
bytes
Content-Length
19353
X-Xss-Protection
1;mode=block
uka-client-main-1.0.0-min.js
apply-mobile.barclaycard/uka-client-app/js/
205 KB
48 KB
Script
General
Full URL
https://apply-mobile.barclaycard/uka-client-app/js/uka-client-main-1.0.0-min.js
Requested by
Host: apply-mobile.barclaycard
URL: https://apply-mobile.barclaycard/lib/require.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.109.58.223 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a104-109-58-223.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
7e96bb6a6a640c01cfb28bf425d9158ef2389570a9c10a404742133f14f5b790
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Frame-Options DENY
X-Xss-Protection 1;mode=block

Request headers

Referer
https://apply-mobile.barclaycard/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 17 Nov 2020 00:37:03 GMT
Content-Encoding
gzip
Vary
accept-encoding
Last-Modified
Wed, 28 Oct 2020 14:29:38 GMT
ETag
W/"be3a-5f998052"
X-frame-options
DENY
Connection
keep-alive
Content-Type
application/x-javascript
Cache-Control
no-cache,max-age=0
Strict-Transport-Security
max-age=63072000; includeSubDomains
Accept-Ranges
bytes
Content-Length
48698
X-Xss-Protection
1;mode=block
base-lib-1.0.0.js
apply-mobile.barclaycard/lib/
614 KB
174 KB
Script
General
Full URL
https://apply-mobile.barclaycard/lib/base-lib-1.0.0.js
Requested by
Host: apply-mobile.barclaycard
URL: https://apply-mobile.barclaycard/lib/require.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.109.58.223 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a104-109-58-223.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
c6de45a5eab55ba3f7205c40e46973befbe8e4323dfa19e8500e02fc26c9d9c8
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Frame-Options DENY
X-Xss-Protection 1;mode=block

Request headers

Referer
https://apply-mobile.barclaycard/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 17 Nov 2020 00:37:04 GMT
Content-Encoding
gzip
Vary
accept-encoding
Last-Modified
Wed, 28 Oct 2020 14:29:38 GMT
ETag
W/"2b597-5f998052"
X-frame-options
DENY
Connection
keep-alive
Content-Type
application/x-javascript
Cache-Control
no-cache,max-age=0
Strict-Transport-Security
max-age=63072000; includeSubDomains
Accept-Ranges
bytes
Content-Length
177559
X-Xss-Protection
1;mode=block
OpenSans-Regular.woff
apply-mobile.barclaycard/lib/themes/barclays/fonts/
62 KB
62 KB
Font
General
Full URL
https://apply-mobile.barclaycard/lib/themes/barclays/fonts/OpenSans-Regular.woff
Requested by
Host: apply-mobile.barclaycard
URL: https://apply-mobile.barclaycard/lib/themes/barclays/css/barclays-base-1.0.0.min.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.109.58.223 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a104-109-58-223.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
2e1587380141daff4e10a8e3db8f7ae5887102ab7576bff43049590f637ac20b
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Frame-Options DENY
X-Xss-Protection 1;mode=block

Request headers

Origin
https://apply-mobile.barclaycard
Referer
https://apply-mobile.barclaycard/lib/themes/barclays/css/barclays-base-1.0.0.min.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 17 Nov 2020 00:37:04 GMT
Content-Encoding
gzip
Vary
accept-encoding
Last-Modified
Wed, 28 Oct 2020 14:29:38 GMT
ETag
W/"f806-5f998052"
X-frame-options
DENY
Connection
keep-alive
Content-Type
text/plain
Cache-Control
no-cache,max-age=0
Strict-Transport-Security
max-age=63072000; includeSubDomains
Accept-Ranges
bytes
Content-Length
63494
X-Xss-Protection
1;mode=block
common-2.1.0-src.js
apply-mobile.barclaycard/lib/
273 KB
41 KB
Script
General
Full URL
https://apply-mobile.barclaycard/lib/common-2.1.0-src.js
Requested by
Host: apply-mobile.barclaycard
URL: https://apply-mobile.barclaycard/lib/require.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.109.58.223 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a104-109-58-223.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
dff3a838119cb12e365d4afa9799d4b5a345942e294c374e61d160a77633b0a0
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Frame-Options DENY
X-Xss-Protection 1;mode=block

Request headers

Referer
https://apply-mobile.barclaycard/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 17 Nov 2020 00:37:04 GMT
Content-Encoding
gzip
Vary
accept-encoding
Last-Modified
Wed, 28 Oct 2020 14:29:39 GMT
ETag
W/"a23a-5f998053"
X-frame-options
DENY
Connection
keep-alive
Content-Type
application/x-javascript
Cache-Control
no-cache,max-age=0
Strict-Transport-Security
max-age=63072000; includeSubDomains
Accept-Ranges
bytes
Content-Length
41530
X-Xss-Protection
1;mode=block
clear
apply-mobile.barclaycard/golf/service/
0
1 KB
XHR
General
Full URL
https://apply-mobile.barclaycard/golf/service/clear
Requested by
Host: apply-mobile.barclaycard
URL: https://apply-mobile.barclaycard/lib/base-lib-1.0.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.109.58.223 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a104-109-58-223.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self'; connect-src 'self'; img-src 'self';style-src 'self' 'unsafe-inline'; frame-ancestors 'self' http://*.intranet.barcapint.com http://*.barclays.intranet https://*.intranet.barcapint.com https://*.barclays.intranet https://eai-a-retail.rfs.barclays.co.uk https://adp22a.rfs.barclays.co.uk:44300 https://federation.client.barclayscorp.com https://federationuat.client.barclayscorp.com;
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN, DENY
X-Xss-Protection 1;mode=block

Request headers

Accept
*/*
Referer
https://apply-mobile.barclaycard/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Security-Policy
default-src 'self'; script-src 'self'; connect-src 'self'; img-src 'self';style-src 'self' 'unsafe-inline'; frame-ancestors 'self' http://*.intranet.barcapint.com http://*.barclays.intranet https://*.intranet.barcapint.com https://*.barclays.intranet https://eai-a-retail.rfs.barclays.co.uk https://adp22a.rfs.barclays.co.uk:44300 https://federation.client.barclayscorp.com https://federationuat.client.barclayscorp.com;
X-content-type-options
nosniff
X-permitted-cross-domain-policies
master-only
X-frame-options
SAMEORIGIN, DENY
Date
Tue, 17 Nov 2020 00:37:04 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains
Content-Type
application/json;charset=UTF-8
Cache-Control
no-cache,max-age=0
Connection
keep-alive
Content-Length
0
X-Xss-Protection
1;mode=block
barclaycard_lt-webfont.woff
apply-mobile.barclaycard/lib/themes/barclays/fonts/
29 KB
29 KB
Font
General
Full URL
https://apply-mobile.barclaycard/lib/themes/barclays/fonts/barclaycard_lt-webfont.woff
Requested by
Host: apply-mobile.barclaycard
URL: https://apply-mobile.barclaycard/lib/themes/barclays/css/barclays-base-1.0.0.min.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.109.58.223 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a104-109-58-223.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
018ce28595c33d7c32cab4efc5c28b970cd94d818a51a5d2dc06f8bea23534a4
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Frame-Options DENY
X-Xss-Protection 1;mode=block

Request headers

Origin
https://apply-mobile.barclaycard
Referer
https://apply-mobile.barclaycard/lib/themes/barclays/css/barclays-base-1.0.0.min.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 17 Nov 2020 00:37:04 GMT
Content-Encoding
gzip
Vary
accept-encoding
Last-Modified
Wed, 28 Oct 2020 14:29:52 GMT
ETag
W/"71e9-5f998060"
X-frame-options
DENY
Connection
keep-alive
Content-Type
text/plain
Cache-Control
no-cache,max-age=0
Strict-Transport-Security
max-age=63072000; includeSubDomains
Accept-Ranges
bytes
Content-Length
29161
X-Xss-Protection
1;mode=block
barclaycard_rg-webfont.woff
apply-mobile.barclaycard/lib/themes/barclays/fonts/
29 KB
29 KB
Font
General
Full URL
https://apply-mobile.barclaycard/lib/themes/barclays/fonts/barclaycard_rg-webfont.woff
Requested by
Host: apply-mobile.barclaycard
URL: https://apply-mobile.barclaycard/lib/themes/barclays/css/barclays-base-1.0.0.min.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.109.58.223 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a104-109-58-223.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
c84dd9504fd7d7ead3a9a6e8e6d52b1d6481a9f7a5ce09b9b278126d91c317c7
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Frame-Options DENY
X-Xss-Protection 1;mode=block

Request headers

Origin
https://apply-mobile.barclaycard
Referer
https://apply-mobile.barclaycard/lib/themes/barclays/css/barclays-base-1.0.0.min.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 17 Nov 2020 00:37:04 GMT
Content-Encoding
gzip
Vary
accept-encoding
Last-Modified
Wed, 28 Oct 2020 14:29:52 GMT
ETag
W/"7349-5f998060"
X-frame-options
DENY
Connection
keep-alive
Content-Type
text/plain
Cache-Control
no-cache,max-age=0
Strict-Transport-Security
max-age=63072000; includeSubDomains
Accept-Ranges
bytes
Content-Length
29513
X-Xss-Protection
1;mode=block

Verdicts & Comments Add Verdict or Comment

24 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes function| requirejs function| require function| define boolean| m object| r object| BIR object| Tagging object| digitalData object| options object| barparm function| _ function| $ function| jQuery object| Backbone function| moment object| jQuery19001333468290333628 function| getIEVersion object| BIRUI number| warningTimer number| sessionTimer

2 Cookies

Domain/Path Name / Value
apply-mobile.barclaycard/ Name: site-id
Value: GLC1
apply-mobile.barclaycard/ Name: BIGipServerapply-mobile-gl_https_pool
Value: 1413349386.18776.0000

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Frame-Options DENY
X-Xss-Protection 1;mode=block