dmca-blog.azurewebsites.net Open in urlscan Pro
13.66.226.80 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php
Effective URL:
https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php
Submission: On July 09 via automatic, source openphish (July 9th 2024, 3:07:46 pm UTC) — Scanned from DE

Summary HTTP 18 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 18 HTTP transactions. The main IP is 13.66.226.80, located in United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is dmca-blog.azurewebsites.net.
TLS certificate: Issued by Microsoft Azure RSA TLS Issuing CA 08 on May 24th 2024. Valid for: a year.

This is the only time dmca-blog.azurewebsites.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: NatWest (Banking)

Domain & IP information

	IP Address		AS Autonomous System
18	13.66.226.80 13.66.226.80		8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
18	1

18 13.66.226.80 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

dmca-blog.azurewebsites.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
18	azurewebsites.net dmca-blog.azurewebsites.net	82 KB
18	1

	Domain	Requested by
18	dmca-blog.azurewebsites.net	dmca-blog.azurewebsites.net
18	1

This site contains no links.

Subject Issuer	Validity	Valid
*.azurewebsites.net Microsoft Azure RSA TLS Issuing CA 08	`2024-05-24` - `2025-05-19`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php
Frame ID: 554B32FC70849FEB109CE7CEA62DB5CB
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php HTTP 307
https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

18
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

82 kB
Transfer

255 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php HTTP 307
https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request details.php Show response dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/ Redirect Chain http://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php	32 KB 7 KB	761ms 182ms	Document text/html	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / PHP/7.4.30 ASP.NET Resource Hash `2f489ab6e80c1236d65b639ab4a3f38d64c973999c25d7f9ebe96ec6f726215c` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Encoding gzip Content-Length 6620 Content-Type text/html; charset=utf-8 Date Tue, 09 Jul 2024 15:07:39 GMT Server Microsoft-IIS/10.0 Vary Accept-Encoding X-Powered-By PHP/7.4.30 ASP.NET Redirect headers Location https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php Non-Authoritative-Reason HttpsUpgrades
GET H/1.1	200 OK	jspostcode.js Show response dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/	12 KB 6 KB	190ms 188ms	Script application/x-javascript	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/jspostcode.js Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `d9eb9b94ab326f6a886f5f7e6673ee4c7dafcbe2e488b8ec741e03293775cec9` Request headers Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Date Tue, 09 Jul 2024 15:07:39 GMT Content-Encoding gzip Last-Modified Mon, 08 Jul 2024 19:19:50 GMT Server Microsoft-IIS/10.0 ETag "b97288cd6bd1da1:0" X-Powered-By ASP.NET Vary Accept-Encoding Content-Type application/x-javascript Accept-Ranges bytes Content-Length 5731
GET H/1.1	200 OK	master.css dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/	133 KB 39 KB	548ms 357ms	Stylesheet text/css	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/master.css Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `75b00a583c89310d12ace059629526ba7cfbb0bd4509ec5750a25fd6ffdd6e12` Request headers Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Date Tue, 09 Jul 2024 15:07:41 GMT Content-Encoding gzip Last-Modified Tue, 02 Jan 2024 09:46:59 GMT Server Microsoft-IIS/10.0 ETag "e0c53ca1603dda1:0" X-Powered-By ASP.NET Vary Accept-Encoding Content-Type text/css Accept-Ranges bytes Content-Length 39612
GET H/1.1	200 OK	datePicker.css dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/	2 KB 1 KB	655ms 178ms	Stylesheet text/css	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/datePicker.css Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `14714f651128eff786763144294b0e7c67529d317ac5371632bbf8fb659866ff` Request headers Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Date Tue, 09 Jul 2024 15:07:41 GMT Content-Encoding gzip Last-Modified Tue, 02 Jan 2024 09:46:59 GMT Server Microsoft-IIS/10.0 ETag "51152ca1603dda1:0" X-Powered-By ASP.NET Vary Accept-Encoding Content-Type text/css Accept-Ranges bytes Content-Length 948
GET H/1.1	200 OK	npc.css dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/	46 KB 12 KB	713ms 235ms	Stylesheet text/css	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/npc.css Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `990f073c20457aa8ecb56a57304e16c90ec7eadb63f25e64932b2f1914054d4a` Request headers Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Date Tue, 09 Jul 2024 15:07:41 GMT Content-Encoding gzip Last-Modified Tue, 02 Jan 2024 09:46:59 GMT Server Microsoft-IIS/10.0 ETag "988a41a1603dda1:0" X-Powered-By ASP.NET Vary Accept-Encoding Content-Type text/css Accept-Ranges bytes Content-Length 12283
GET H/1.1	200 OK	overlayPromptMaster.css dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/	2 KB 1010 B	668ms 182ms	Stylesheet text/css	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/overlayPromptMaster.css Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `643d4d52a1a24515822f6a30683f901bb5dd16c251d88caece27ab2713457272` Request headers Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Date Tue, 09 Jul 2024 15:07:41 GMT Content-Encoding gzip Last-Modified Tue, 02 Jan 2024 09:46:59 GMT Server Microsoft-IIS/10.0 ETag "988a41a1603dda1:0" X-Powered-By ASP.NET Vary Accept-Encoding Content-Type text/css Accept-Ranges bytes Content-Length 716
GET H/1.1	200 OK	overlayPrompt.css dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/	76 B 475 B	677ms 182ms	Stylesheet text/css	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/overlayPrompt.css Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `ef7db794b4a6b5c42d2535919d91fb11da1e5cd1147f35196db382197b35fdee` Request headers Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Date Tue, 09 Jul 2024 15:07:41 GMT Content-Encoding gzip Last-Modified Tue, 02 Jan 2024 09:46:59 GMT Server Microsoft-IIS/10.0 ETag "5d3c33a1603dda1:0" X-Powered-By ASP.NET Vary Accept-Encoding Content-Type text/css Accept-Ranges bytes Content-Length 181
GET H/1.1	200 OK	master_mobile.css dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/	18 KB 7 KB	685ms 190ms	Stylesheet text/css	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/master_mobile.css Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `8d19ce7511c97d861471b938de9d7a3375599c0326f5ea6d72a362ebbded1bcd` Request headers Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Date Tue, 09 Jul 2024 15:07:41 GMT Content-Encoding gzip Last-Modified Tue, 02 Jan 2024 09:46:59 GMT Server Microsoft-IIS/10.0 ETag "51152ca1603dda1:0" X-Powered-By ASP.NET Vary Accept-Encoding Content-Type text/css Accept-Ranges bytes Content-Length 6376
GET H/1.1	200 OK	logo.png dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/	3 KB 3 KB	626ms 169ms	Image image/png	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/logo.png Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `917942589e5b140755ee83bb4720ca9c1bbf7705f44f51a78ba1ffa635420c50` Request headers Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Date Tue, 09 Jul 2024 15:07:41 GMT Last-Modified Tue, 02 Jan 2024 09:46:59 GMT Server Microsoft-IIS/10.0 ETag "d19e35a1603dda1:0" X-Powered-By ASP.NET Content-Type image/png Accept-Ranges bytes Content-Length 3053
GET H/1.1	200 OK	alert-icon.png dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/	638 B 886 B	169ms 169ms	Image image/png	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/alert-icon.png Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `d4901081a59d75050d215c08d6fd5370cea9aa1eaea023a176c9b9c26760f221` Request headers Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Date Tue, 09 Jul 2024 15:07:41 GMT Last-Modified Tue, 02 Jan 2024 09:46:59 GMT Server Microsoft-IIS/10.0 ETag "d19e35a1603dda1:0" X-Powered-By ASP.NET Content-Type image/png Accept-Ranges bytes Content-Length 638
GET H/1.1	200 OK	NPC_auralstyle.css dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/	515 B 701 B	172ms 172ms	Stylesheet text/css	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/NPC_auralstyle.css Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `04c45c81e1298e703f3bde9cec27446450294330ae06bd24c9f9343b264462e9` Request headers Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Date Tue, 09 Jul 2024 15:07:41 GMT Content-Encoding gzip Last-Modified Tue, 02 Jan 2024 09:46:59 GMT Server Microsoft-IIS/10.0 ETag "45283fa1603dda1:0" X-Powered-By ASP.NET Vary Accept-Encoding Content-Type text/css Accept-Ranges bytes Content-Length 407
GET H/1.1	200 OK	master_print.css dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/	5 KB 2 KB	182ms 182ms	Stylesheet text/css	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/master_print.css Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `1acd7d03edc5d90866fd012355c352efbb02f38c9334cffd4a9f321b4d713491` Request headers Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Date Tue, 09 Jul 2024 15:07:41 GMT Content-Encoding gzip Last-Modified Tue, 02 Jan 2024 09:46:59 GMT Server Microsoft-IIS/10.0 ETag "33138a1603dda1:0" X-Powered-By ASP.NET Vary Accept-Encoding Content-Type text/css Accept-Ranges bytes Content-Length 2154
GET H/1.1	200 OK	exit-icon-white.svg dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/	641 B 892 B	167ms 167ms	Image image/svg+xml	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/exit-icon-white.svg Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/master.css Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `43a780414ddf2b15e9b47811bbaa8cbfc6cf56d4db65684ed114a1c2a13bc097` Request headers Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/master.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Date Tue, 09 Jul 2024 15:07:41 GMT Last-Modified Tue, 02 Jan 2024 09:46:59 GMT Server Microsoft-IIS/10.0 ETag "33138a1603dda1:0" X-Powered-By ASP.NET Content-Type image/svg+xml Accept-Ranges bytes Content-Length 641
GET H/1.1	404 Not Found	RNHouseSansW03-Regular.woff dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/	0 0	167ms 166ms	Font text/html	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/RNHouseSansW03-Regular.woff Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/npc.css Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash Request headers Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/npc.css Origin https://dmca-blog.azurewebsites.net User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Date Tue, 09 Jul 2024 15:07:41 GMT Server Microsoft-IIS/10.0 X-Powered-By ASP.NET Content-Length 103 Content-Type text/html
GET H/1.1	404 Not Found	RNHouseSansW03-Bold.woff dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/	0 0	233ms 160ms	Font text/html	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/RNHouseSansW03-Bold.woff Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/npc.css Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash Request headers Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/npc.css Origin https://dmca-blog.azurewebsites.net User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Date Tue, 09 Jul 2024 15:07:41 GMT Server Microsoft-IIS/10.0 X-Powered-By ASP.NET Content-Length 103 Content-Type text/html
GET H/1.1	404 Not Found	RNHouseSansW03-Regular.ttf dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/fonts/	0 0	165ms 165ms	Font text/html	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/fonts/RNHouseSansW03-Regular.ttf Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/npc.css Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash Request headers Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/npc.css Origin https://dmca-blog.azurewebsites.net User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Date Tue, 09 Jul 2024 15:07:41 GMT Server Microsoft-IIS/10.0 X-Powered-By ASP.NET Content-Length 103 Content-Type text/html
GET H/1.1	404 Not Found	RNHouseSansW03-Bold.ttf dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/fonts/	0 0	159ms 159ms	Font text/html	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/fonts/RNHouseSansW03-Bold.ttf Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/npc.css Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash Request headers Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/npc.css Origin https://dmca-blog.azurewebsites.net User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Date Tue, 09 Jul 2024 15:07:41 GMT Server Microsoft-IIS/10.0 X-Powered-By ASP.NET Content-Length 103 Content-Type text/html
GET H/1.1	404 Not Found	favicon.ico dmca-blog.azurewebsites.net/	103 B 263 B	160ms 160ms	Other text/html	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/favicon.ico Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `90b2d35cd5e08370ed20db81197dd9da1a4dbb421f71293fd5733ea49eb7b3e1` Request headers Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Date Tue, 09 Jul 2024 15:07:41 GMT Server Microsoft-IIS/10.0 X-Powered-By ASP.NET Content-Length 103 Content-Type text/html

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: NatWest (Banking)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.dmca-blog.azurewebsites.net/	1969-12-31 23:59:59	Name: ARRAffinity Value: 3adacca6c2f81875efead5591d2a8d02faa6e8843c1dd1a10e8da178ce234c0c
			.dmca-blog.azurewebsites.net/	1969-12-31 23:59:59	Name: ARRAffinitySameSite Value: 3adacca6c2f81875efead5591d2a8d02faa6e8843c1dd1a10e8da178ce234c0c

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/RNHouseSansW03-Regular.woff Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/RNHouseSansW03-Bold.woff Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/fonts/RNHouseSansW03-Regular.ttf Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/fonts/RNHouseSansW03-Bold.ttf Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://dmca-blog.azurewebsites.net/favicon.ico Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

dmca-blog.azurewebsites.net
13.66.226.80
04c45c81e1298e703f3bde9cec27446450294330ae06bd24c9f9343b264462e9
14714f651128eff786763144294b0e7c67529d317ac5371632bbf8fb659866ff
1acd7d03edc5d90866fd012355c352efbb02f38c9334cffd4a9f321b4d713491
2f489ab6e80c1236d65b639ab4a3f38d64c973999c25d7f9ebe96ec6f726215c
43a780414ddf2b15e9b47811bbaa8cbfc6cf56d4db65684ed114a1c2a13bc097
643d4d52a1a24515822f6a30683f901bb5dd16c251d88caece27ab2713457272
75b00a583c89310d12ace059629526ba7cfbb0bd4509ec5750a25fd6ffdd6e12
8d19ce7511c97d861471b938de9d7a3375599c0326f5ea6d72a362ebbded1bcd
90b2d35cd5e08370ed20db81197dd9da1a4dbb421f71293fd5733ea49eb7b3e1
917942589e5b140755ee83bb4720ca9c1bbf7705f44f51a78ba1ffa635420c50
990f073c20457aa8ecb56a57304e16c90ec7eadb63f25e64932b2f1914054d4a
d4901081a59d75050d215c08d6fd5370cea9aa1eaea023a176c9b9c26760f221
d9eb9b94ab326f6a886f5f7e6673ee4c7dafcbe2e488b8ec741e03293775cec9
ef7db794b4a6b5c42d2535919d91fb11da1e5cd1147f35196db382197b35fdee

dmca-blog.azurewebsites.net Open in urlscan Pro 13.66.226.80 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

18 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

82 kBTransfer

255 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

2 Cookies

5 Console Messages

Indicators

dmca-blog.azurewebsites.net Open in urlscan Pro
13.66.226.80 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

18
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

82 kB
Transfer

255 kB
Size

2
Cookies

18 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!