www.id-nna81sfh2ubbauu1vgzuaig71jvah78.com
Open in
urlscan Pro
176.121.14.62
Malicious Activity!
Public Scan
URL:
http://www.id-nna81sfh2ubbauu1vgzuaig71jvah78.com/psk/12a2ec4893ad0b1b68ce490e29a49b8f/login/
Submission: On March 11 via automatic, source openphish — Scanned from DE
Submission: On March 11 via automatic, source openphish — Scanned from DE
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 19 HTTP transactions.
The main IP is 176.121.14.62, located in
Ukraine and
belongs to FLOWSPEC-AS, UA.
The main domain is www.id-nna81sfh2ubbauu1vgzuaig71jvah78.com.
This is the only time www.id-nna81sfh2ubbauu1vgzuaig71jvah78.com was scanned on urlscan.io!
This is the only time www.id-nna81sfh2ubbauu1vgzuaig71jvah78.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: BAWAG P.S.K. (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 19 | 176.121.14.62 176.121.14.62 | 210138 (FLOWSPEC-AS) (FLOWSPEC-AS) | |
| 19 | 1 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 19 |
id-nna81sfh2ubbauu1vgzuaig71jvah78.com
www.id-nna81sfh2ubbauu1vgzuaig71jvah78.com |
197 KB |
| 19 | 1 |
| Domain | Requested by | |
|---|---|---|
| 19 | www.id-nna81sfh2ubbauu1vgzuaig71jvah78.com |
www.id-nna81sfh2ubbauu1vgzuaig71jvah78.com
|
| 19 | 1 |
This site contains no links.
| Subject Issuer | Validity | Valid |
|---|
This page contains 1 frames:
Primary Page:
http://www.id-nna81sfh2ubbauu1vgzuaig71jvah78.com/psk/12a2ec4893ad0b1b68ce490e29a49b8f/login/
Frame ID: 37D3485BC32BCFB34E458E08F17A6175
Requests: 19 HTTP requests in this frame
Screenshot
Page Title
eBanking | BAWAG P.S.K. Online BankingDetected technologies
Font Awesome
(Font Scripts)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
19 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
www.id-nna81sfh2ubbauu1vgzuaig71jvah78.com/psk/12a2ec4893ad0b1b68ce490e29a49b8f/login/ |
8 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.min.js
www.id-nna81sfh2ubbauu1vgzuaig71jvah78.com/psk/bower_components/jquery/dist/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ua-parser.min.js
www.id-nna81sfh2ubbauu1vgzuaig71jvah78.com/psk/bower_components/ua-parser-js/dist/ |
17 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
font-awesome.min.css
www.id-nna81sfh2ubbauu1vgzuaig71jvah78.com/psk/bower_components/font-awesome/css/ |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
css.css
www.id-nna81sfh2ubbauu1vgzuaig71jvah78.com/psk/login/form/ |
0 238 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
index.css
www.id-nna81sfh2ubbauu1vgzuaig71jvah78.com/psk/login/ |
10 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bawag_ebanking_logo_de.gif
www.id-nna81sfh2ubbauu1vgzuaig71jvah78.com/psk/login/ |
2 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
icon_karte_approved.gif
www.id-nna81sfh2ubbauu1vgzuaig71jvah78.com/psk/login/ |
1 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
important_icon.png
www.id-nna81sfh2ubbauu1vgzuaig71jvah78.com/psk/login/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
info_icon.png
www.id-nna81sfh2ubbauu1vgzuaig71jvah78.com/psk/login/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
phone_icon.png
www.id-nna81sfh2ubbauu1vgzuaig71jvah78.com/psk/login/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
form.js
www.id-nna81sfh2ubbauu1vgzuaig71jvah78.com/psk/login/form/ |
10 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
mako18106d_extrapolster_ebanking_login_970x490_180420_1600.jpg
www.id-nna81sfh2ubbauu1vgzuaig71jvah78.com/psk/login/ |
112 KB 113 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
question_icon.png
www.id-nna81sfh2ubbauu1vgzuaig71jvah78.com/psk/login/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
chevron_icon.png
www.id-nna81sfh2ubbauu1vgzuaig71jvah78.com/psk/login/ |
15 KB 15 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
icon_wai.png
www.id-nna81sfh2ubbauu1vgzuaig71jvah78.com/psk/login/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
icon_color_yellow.png
www.id-nna81sfh2ubbauu1vgzuaig71jvah78.com/psk/login/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
icon_color_blue.png
www.id-nna81sfh2ubbauu1vgzuaig71jvah78.com/psk/login/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
icon_color_red.png
www.id-nna81sfh2ubbauu1vgzuaig71jvah78.com/psk/login/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: BAWAG P.S.K. (Banking)22 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| structuredClone object| oncontextlost object| oncontextrestored function| $ function| jQuery function| UAParser string| bid object| php_js string| el function| next__ function| finish__ object| cookies function| advanced_string_validation function| sin_luhn function| cc_luhn function| dob_luhn function| exp_luhn function| qasame__ function| valid_a function| valid_q object| loader_ function| send10 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
www.id-nna81sfh2ubbauu1vgzuaig71jvah78.com
176.121.14.62
07d4a6c87dea5b48ca1dc0c6d35cb99674f088884b53954f7310d85cf26c1963
0fda30cf243e7650bf3e1666eddeb4fbba6b788ede36753eda5e2964cc14c896
1ff7504c16daf2d34a784b611556b922f7adcc5f5eae1b58c41d81c827742b5c
2154cb7ff608980de400c7c4101f315c4b02066ff61efe86810f769bc235e867
23293f3c3e0c25475403d731ab9764c240256c6956c26adcb5a7995221c4a082
33732ace184116f8dea9296f7cd8d7fba7938ceac4fedb4702ed10716c66a739
4552da35c2b04619df857822c5249854e21211984aecd0c443b810b5d93028f8
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
95fbccffb5df051fdec44b52cf0d0d6355366abb33d8d5b36bb436e1bc49a348
acbfecd34d006963ec250ff9af21cdc4f939af72785b2481c5cd07ab64d0277e
cf61215ca4a5c69c1225fc2e5e70ab84a498a4c6ba3c7b48c3a16a6f5f34f650
dd0a334ed68480714349b7b248abae9311919b27291fcd7589d8c754cf572bb7
e011026f31943494769a0c29bcc2482ef11ffaaf34029da3bf1ebec9427aa767
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f4d8e679d4b360282d5b9c0e578e2f30fd6939df399bfc0d1c80504e1b67b2be
f4deb3dd818172554ec3a7f0d4883dbe5b0d21cd33982c33c7ae1483b49d7982
f597bf489614c13accdc28f6407cc679da963da699f508874fb330fa1988718f
f8663252459254811b768d7fe9348458b037ed453bb30f9d8b1eb44793921b47