clientdataprotect-nbg.gr Open in urlscan Pro
2.56.247.247 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://clientdataprotect-nbg.gr/santander/
Effective URL:
https://clientdataprotect-nbg.gr/santander/login/
Submission: On November 10 via api (November 10th 2023, 3:02:41 pm UTC) from ES — Scanned from FR

Summary HTTP 2 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 2 HTTP transactions. The main IP is 2.56.247.247, located in Nanterre, France and belongs to SAPINET-AS, FR. The main domain is clientdataprotect-nbg.gr.
TLS certificate: Issued by R3 on October 27th 2023. Valid for: 3 months.

This is the only time clientdataprotect-nbg.gr was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Santander (Banking)

Domain & IP information

	IP Address		AS Autonomous System
2 4	2.56.247.247 2.56.247.247		39421 (SAPINET-AS) (SAPINET-AS)
2	2

4 2.56.247.247 (Nanterre, France) 2 redirects

ASN39421 (SAPINET-AS, FR)

clientdataprotect-nbg.gr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	clientdataprotect-nbg.gr 2 redirects clientdataprotect-nbg.gr	320 KB
2	1

	Domain	Requested by
4	clientdataprotect-nbg.gr	2 redirects clientdataprotect-nbg.gr
2	1

This site contains no links.

Subject Issuer	Validity	Valid
clientdataprotect-nbg.gr R3	`2023-10-27` - `2024-01-25`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://clientdataprotect-nbg.gr/santander/login/
Frame ID: DB865487ED88A624F461417500FFF94D
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Home Banking

Page URL History Show full URLs

https://clientdataprotect-nbg.gr/santander/ HTTP 302
https://clientdataprotect-nbg.gr/santander/login HTTP 301
https://clientdataprotect-nbg.gr/santander/login/ Page URL

Page Statistics

2
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

499 kB
Transfer

857 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://clientdataprotect-nbg.gr/santander/ HTTP 302
https://clientdataprotect-nbg.gr/santander/login HTTP 301
https://clientdataprotect-nbg.gr/santander/login/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions
7 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response clientdataprotect-nbg.gr/santander/login/ Redirect Chain https://clientdataprotect-nbg.gr/santander/ https://clientdataprotect-nbg.gr/santander/login https://clientdataprotect-nbg.gr/santander/login/	220 KB 150 KB	70ms 70ms	Document text/html	2.56.247.247 SAPINET-AS
General Check archive.org Show headers Download Go to Full URL https://clientdataprotect-nbg.gr/santander/login/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.56.247.247 Nanterre, France, ASN39421 (SAPINET-AS, FR), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `8a4e34b29798dcc4d16db79a771717635ff6a3c93df96ec8d8b168b119b037c9` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36 accept-language fr-FR,fr;q=0.9 Response headers content-encoding br content-type text/html; charset=UTF-8 date Fri, 10 Nov 2023 15:02:35 GMT server Microsoft-IIS/10.0 vary Accept-Encoding x-powered-by ASP.NET x-powered-by-plesk PleskWin Redirect headers content-length 184 content-type text/html; charset=UTF-8 date Fri, 10 Nov 2023 15:02:35 GMT location https://clientdataprotect-nbg.gr/santander/login/ server Microsoft-IIS/10.0 x-powered-by ASP.NET x-powered-by-plesk PleskWin
GET H2	200	style.css clientdataprotect-nbg.gr/santander/login/	330 KB 169 KB	112ms 111ms	Stylesheet text/css	2.56.247.247 SAPINET-AS
General Check archive.org Show headers Download Go to Full URL https://clientdataprotect-nbg.gr/santander/login/style.css Requested by Host: clientdataprotect-nbg.gr URL: https://clientdataprotect-nbg.gr/santander/login/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.56.247.247 Nanterre, France, ASN39421 (SAPINET-AS, FR), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `7985fab36903760712e3255b98bad01dcbe9f161a361515a2c8a045702a974cc` Request headers accept-language fr-FR,fr;q=0.9 Referer https://clientdataprotect-nbg.gr/santander/login/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36 Response headers x-powered-by-plesk PleskWin date Fri, 10 Nov 2023 15:02:35 GMT content-encoding br last-modified Fri, 10 Nov 2023 14:11:21 GMT server Microsoft-IIS/10.0 etag "80cab4c7df13da1:0" x-powered-by ASP.NET vary Accept-Encoding content-type text/css accept-ranges bytes content-length 173264
GET DATA	200 OK	truncated /	128 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a7152dd6cfd84bfdc5576620c404e6c967d917f0da52ca6fd6b2548f45c84a15` Request headers accept-language fr-FR,fr;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	2 KB 2 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `34c273e935b259fb904d9d78e53548ce984d3838b045f11eaec0444d14e73559` Request headers Referer Origin https://clientdataprotect-nbg.gr accept-language fr-FR,fr;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36 Response headers Content-Type font/woff2
GET DATA	200 OK	truncated /	68 KB 68 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `c9f7e218b19e6c3c3db1e54d5a876309f95ce695c3cc8bc5d0b16513fc88baae` Request headers Referer Origin https://clientdataprotect-nbg.gr accept-language fr-FR,fr;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36 Response headers Content-Type font/woff2
GET DATA	200 OK	truncated /	35 KB 35 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `3ed4606acf5b41ffe0d3fbc4eb9f84ad79d9c8b7a6e0007896667fd6359f541c` Request headers Referer Origin https://clientdataprotect-nbg.gr accept-language fr-FR,fr;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36 Response headers Content-Type font/woff2
GET DATA	200 OK	truncated /	34 KB 34 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `b8c9e126d6239234ecac3acea24620d0c8ee71ba72509e58cc72aadb4aa73a54` Request headers Referer Origin https://clientdataprotect-nbg.gr accept-language fr-FR,fr;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36 Response headers Content-Type font/woff2
GET DATA	200 OK	truncated /	33 KB 33 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `8dc23ac1fc1a2d9fe17d4f8d70514a302c1d686b0c06ef9b4c3ec34ca593c1d3` Request headers Referer Origin https://clientdataprotect-nbg.gr accept-language fr-FR,fr;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36 Response headers Content-Type font/woff2
GET DATA	200 OK	truncated /	8 KB 8 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `e69dcb36c97e11b9ce1b1a39cc9070e44185eeb4611fd39706943ef1ea53d287` Request headers Referer Origin https://clientdataprotect-nbg.gr accept-language fr-FR,fr;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36 Response headers Content-Type font/woff2

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Santander (Banking)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

clientdataprotect-nbg.gr
2.56.247.247
34c273e935b259fb904d9d78e53548ce984d3838b045f11eaec0444d14e73559
3ed4606acf5b41ffe0d3fbc4eb9f84ad79d9c8b7a6e0007896667fd6359f541c
7985fab36903760712e3255b98bad01dcbe9f161a361515a2c8a045702a974cc
8a4e34b29798dcc4d16db79a771717635ff6a3c93df96ec8d8b168b119b037c9
8dc23ac1fc1a2d9fe17d4f8d70514a302c1d686b0c06ef9b4c3ec34ca593c1d3
a7152dd6cfd84bfdc5576620c404e6c967d917f0da52ca6fd6b2548f45c84a15
b8c9e126d6239234ecac3acea24620d0c8ee71ba72509e58cc72aadb4aa73a54
c9f7e218b19e6c3c3db1e54d5a876309f95ce695c3cc8bc5d0b16513fc88baae
e69dcb36c97e11b9ce1b1a39cc9070e44185eeb4611fd39706943ef1ea53d287

clientdataprotect-nbg.gr Open in urlscan Pro 2.56.247.247 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

2 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

499 kBTransfer

857 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 7 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

13 JavaScript Global Variables

0 Cookies

Indicators

clientdataprotect-nbg.gr Open in urlscan Pro
2.56.247.247 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

2
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

499 kB
Transfer

857 kB
Size

0
Cookies

2 HTTP transactions
7 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!