dmca-blog.azurewebsites.net Open in urlscan Pro
13.66.226.80 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/details.php
Submission: On July 05 via automatic, source phishtank (July 5th 2024, 12:41:30 am UTC) — Scanned from DE

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 13 HTTP transactions. The main IP is 13.66.226.80, located in United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is dmca-blog.azurewebsites.net.
TLS certificate: Issued by Microsoft Azure RSA TLS Issuing CA 08 on May 24th 2024. Valid for: a year.

This is the only time dmca-blog.azurewebsites.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: NatWest (Banking)

Domain & IP information

	IP Address		AS Autonomous System
13	13.66.226.80 13.66.226.80		8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
13	1

13 13.66.226.80 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

dmca-blog.azurewebsites.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	azurewebsites.net dmca-blog.azurewebsites.net	43 KB
13	1

	Domain	Requested by
13	dmca-blog.azurewebsites.net	dmca-blog.azurewebsites.net
13	1

This site contains no links.

Subject Issuer	Validity	Valid
*.azurewebsites.net Microsoft Azure RSA TLS Issuing CA 08	`2024-05-24` - `2025-05-19`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/details.php
Frame ID: A94C3BA317C003CE4DF6AB0996B681A6
Requests: 1 HTTP requests in this frame

Frame: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php
Frame ID: 940E34483449B70FC368B28D8D7C15CD
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Confirm Your Details

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

13
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

43 kB
Transfer

246 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request details.php Show response dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/	969 B 1 KB	687ms 166ms	Document text/html	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/details.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / PHP/7.4.30 ASP.NET Resource Hash `e5148cb68d0d3f39d343b2b20e1c02b5b1e65817dac51fe6f54dbcd9868720da` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers Cache-Control no-store, no-cache, must-revalidate Content-Encoding gzip Content-Length 690 Content-Type text/html; charset=utf-8 Date Fri, 05 Jul 2024 00:41:26 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Pragma no-cache Server Microsoft-IIS/10.0 Vary Accept-Encoding X-Powered-By PHP/7.4.30 ASP.NET
GET H/1.1	200 OK	details.php Show response dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/ Frame 940E	32 KB 7 KB	2078ms 2077ms	Document text/html	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/details.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / PHP/7.4.30 ASP.NET Resource Hash `e7c8af78c0b3cc30d3723a09933b19198946cd0a7aa1fb4838522746a6c618df` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/details.php Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers Content-Encoding gzip Content-Length 6621 Content-Type text/html; charset=utf-8 Date Fri, 05 Jul 2024 00:41:26 GMT Server Microsoft-IIS/10.0 Vary Accept-Encoding X-Powered-By PHP/7.4.30 ASP.NET
GET H/1.1	200 OK	jspostcode.js Show response dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/ Frame 940E	12 KB 6 KB	206ms 205ms	Script application/x-javascript	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/jspostcode.js Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `5b5b18035f2e7a1a23feae2bc3235657b1168012a5010a08826755f01773c231` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Fri, 05 Jul 2024 00:41:29 GMT Content-Encoding gzip Last-Modified Wed, 28 Feb 2024 02:55:24 GMT Server Microsoft-IIS/10.0 ETag "16f2ca93f169da1:0" X-Powered-By ASP.NET Vary Accept-Encoding Content-Type application/x-javascript Accept-Ranges bytes Content-Length 5752
GET H/1.1	200 OK	master.css dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/ Frame 940E	123 KB 0	733ms 368ms	Stylesheet text/css	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/master.css Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Fri, 05 Jul 2024 00:41:29 GMT Content-Encoding gzip Last-Modified Tue, 02 Jan 2024 09:46:59 GMT Server Microsoft-IIS/10.0 ETag "e0c53ca1603dda1:0" X-Powered-By ASP.NET Vary Accept-Encoding Content-Type text/css Accept-Ranges bytes Content-Length 39612
GET H/1.1	200 OK	datePicker.css dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/ Frame 940E	2 KB 1 KB	659ms 185ms	Stylesheet text/css	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/datePicker.css Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `14714f651128eff786763144294b0e7c67529d317ac5371632bbf8fb659866ff` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Fri, 05 Jul 2024 00:41:29 GMT Content-Encoding gzip Last-Modified Tue, 02 Jan 2024 09:46:59 GMT Server Microsoft-IIS/10.0 ETag "51152ca1603dda1:0" X-Powered-By ASP.NET Vary Accept-Encoding Content-Type text/css Accept-Ranges bytes Content-Length 948
GET H/1.1	200 OK	npc.css dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/ Frame 940E	46 KB 12 KB	686ms 212ms	Stylesheet text/css	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/npc.css Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `990f073c20457aa8ecb56a57304e16c90ec7eadb63f25e64932b2f1914054d4a` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Fri, 05 Jul 2024 00:41:29 GMT Content-Encoding gzip Last-Modified Tue, 02 Jan 2024 09:46:59 GMT Server Microsoft-IIS/10.0 ETag "988a41a1603dda1:0" X-Powered-By ASP.NET Vary Accept-Encoding Content-Type text/css Accept-Ranges bytes Content-Length 12283
GET H/1.1	200 OK	overlayPromptMaster.css dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/ Frame 940E	2 KB 1010 B	637ms 164ms	Stylesheet text/css	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/overlayPromptMaster.css Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `643d4d52a1a24515822f6a30683f901bb5dd16c251d88caece27ab2713457272` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Fri, 05 Jul 2024 00:41:29 GMT Content-Encoding gzip Last-Modified Tue, 02 Jan 2024 09:46:59 GMT Server Microsoft-IIS/10.0 ETag "988a41a1603dda1:0" X-Powered-By ASP.NET Vary Accept-Encoding Content-Type text/css Accept-Ranges bytes Content-Length 716
GET H/1.1	200 OK	overlayPrompt.css dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/ Frame 940E	76 B 475 B	646ms 169ms	Stylesheet text/css	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/overlayPrompt.css Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `ef7db794b4a6b5c42d2535919d91fb11da1e5cd1147f35196db382197b35fdee` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Fri, 05 Jul 2024 00:41:29 GMT Content-Encoding gzip Last-Modified Tue, 02 Jan 2024 09:46:59 GMT Server Microsoft-IIS/10.0 ETag "5d3c33a1603dda1:0" X-Powered-By ASP.NET Vary Accept-Encoding Content-Type text/css Accept-Ranges bytes Content-Length 181
GET H/1.1	200 OK	master_mobile.css dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/ Frame 940E	18 KB 7 KB	669ms 186ms	Stylesheet text/css	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/master_mobile.css Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `8d19ce7511c97d861471b938de9d7a3375599c0326f5ea6d72a362ebbded1bcd` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Fri, 05 Jul 2024 00:41:29 GMT Content-Encoding gzip Last-Modified Tue, 02 Jan 2024 09:46:59 GMT Server Microsoft-IIS/10.0 ETag "51152ca1603dda1:0" X-Powered-By ASP.NET Vary Accept-Encoding Content-Type text/css Accept-Ranges bytes Content-Length 6376
GET H/1.1	200 OK	logo.png dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/ Frame 940E	3 KB 3 KB	432ms 165ms	Image image/png	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/logo.png Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `917942589e5b140755ee83bb4720ca9c1bbf7705f44f51a78ba1ffa635420c50` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Fri, 05 Jul 2024 00:41:29 GMT Last-Modified Tue, 02 Jan 2024 09:46:59 GMT Server Microsoft-IIS/10.0 ETag "d19e35a1603dda1:0" X-Powered-By ASP.NET Content-Type image/png Accept-Ranges bytes Content-Length 3053
GET H/1.1	200 OK	alert-icon.png dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/ Frame 940E	638 B 886 B	167ms 167ms	Image image/png	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/alert-icon.png Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `d4901081a59d75050d215c08d6fd5370cea9aa1eaea023a176c9b9c26760f221` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Fri, 05 Jul 2024 00:41:29 GMT Last-Modified Tue, 02 Jan 2024 09:46:59 GMT Server Microsoft-IIS/10.0 ETag "d19e35a1603dda1:0" X-Powered-By ASP.NET Content-Type image/png Accept-Ranges bytes Content-Length 638
GET H/1.1	200 OK	NPC_auralstyle.css dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/ Frame 940E	515 B 701 B	171ms 171ms	Stylesheet text/css	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/NPC_auralstyle.css Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `04c45c81e1298e703f3bde9cec27446450294330ae06bd24c9f9343b264462e9` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Fri, 05 Jul 2024 00:41:29 GMT Content-Encoding gzip Last-Modified Tue, 02 Jan 2024 09:46:59 GMT Server Microsoft-IIS/10.0 ETag "45283fa1603dda1:0" X-Powered-By ASP.NET Vary Accept-Encoding Content-Type text/css Accept-Ranges bytes Content-Length 407
GET H/1.1	200 OK	master_print.css dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/ Frame 940E	5 KB 2 KB	173ms 173ms	Stylesheet text/css	13.66.226.80 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/master_print.css Requested by Host: dmca-blog.azurewebsites.net URL: https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 13.66.226.80 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `1acd7d03edc5d90866fd012355c352efbb02f38c9334cffd4a9f321b4d713491` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://dmca-blog.azurewebsites.net/wp-content/nunu/natwest3/mobile/security_files/details.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Fri, 05 Jul 2024 00:41:29 GMT Content-Encoding gzip Last-Modified Tue, 02 Jan 2024 09:46:59 GMT Server Microsoft-IIS/10.0 ETag "33138a1603dda1:0" X-Powered-By ASP.NET Vary Accept-Encoding Content-Type text/css Accept-Ranges bytes Content-Length 2154

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: NatWest (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 undefined| event object| fence object| sharedStorage

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
dmca-blog.azurewebsites.net/	1969-12-31 23:59:59	Name: PHPSESSID Value: jthir4kshjv4i117sukhme6bv7
.dmca-blog.azurewebsites.net/	1969-12-31 23:59:59	Name: ARRAffinity Value: 3adacca6c2f81875efead5591d2a8d02faa6e8843c1dd1a10e8da178ce234c0c
.dmca-blog.azurewebsites.net/	1969-12-31 23:59:59	Name: ARRAffinitySameSite Value: 3adacca6c2f81875efead5591d2a8d02faa6e8843c1dd1a10e8da178ce234c0c

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

dmca-blog.azurewebsites.net
13.66.226.80
04c45c81e1298e703f3bde9cec27446450294330ae06bd24c9f9343b264462e9
14714f651128eff786763144294b0e7c67529d317ac5371632bbf8fb659866ff
1acd7d03edc5d90866fd012355c352efbb02f38c9334cffd4a9f321b4d713491
5b5b18035f2e7a1a23feae2bc3235657b1168012a5010a08826755f01773c231
643d4d52a1a24515822f6a30683f901bb5dd16c251d88caece27ab2713457272
8d19ce7511c97d861471b938de9d7a3375599c0326f5ea6d72a362ebbded1bcd
917942589e5b140755ee83bb4720ca9c1bbf7705f44f51a78ba1ffa635420c50
990f073c20457aa8ecb56a57304e16c90ec7eadb63f25e64932b2f1914054d4a
d4901081a59d75050d215c08d6fd5370cea9aa1eaea023a176c9b9c26760f221
e5148cb68d0d3f39d343b2b20e1c02b5b1e65817dac51fe6f54dbcd9868720da
e7c8af78c0b3cc30d3723a09933b19198946cd0a7aa1fb4838522746a6c618df
ef7db794b4a6b5c42d2535919d91fb11da1e5cd1147f35196db382197b35fdee

dmca-blog.azurewebsites.net Open in urlscan Pro 13.66.226.80 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

43 kBTransfer

246 kBSize

3 Cookies

0 Outgoing links

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

3 Cookies

Indicators

dmca-blog.azurewebsites.net Open in urlscan Pro
13.66.226.80 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

43 kB
Transfer

246 kB
Size

3
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!