Report - nw-protection-portal.com/Login.php

Report Overview

Visited public
2025-04-28 23:29:26
Tags
natwest financial phishing
URL
nw-protection-portal.com/Login.php
Finishing URL
nw-protection-portal.com/Login.php
IP / ASN
83.222.191.208
#212283 Roza Holidays Eood
Title
Log in to Online Banking
Phishing - NatWest

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
nw-protection-portal.com	unknown	2025-04-28	2025-04-28	2025-04-28	8.7 kB	873 kB	83.222.191.208

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2025-04-28 23:28:53	medium	83.222.191.208	Client IP	ET DROP Spamhaus DROP Listed Traffic Inbound group 8
2025-04-28 23:28:53	medium	83.222.191.208	Client IP	ET DROP Dshield Block Listed Source group 1

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2025-04-28	medium	nw-protection-portal.com/	NatWest Personal Banking
2025-04-28	medium	nw-protection-portal.com/	NatWest Personal Banking
2025-04-28	medium	nw-protection-portal.com/	NatWest Personal Banking
2025-04-28	medium	nw-protection-portal.com/	NatWest Personal Banking
2025-04-28	medium	nw-protection-portal.com/	NatWest Personal Banking
2025-04-28	medium	nw-protection-portal.com/	NatWest Personal Banking
2025-04-28	medium	nw-protection-portal.com/	NatWest Personal Banking
2025-04-28	medium	nw-protection-portal.com/	NatWest Personal Banking
2025-04-28	medium	nw-protection-portal.com/	NatWest Personal Banking
2025-04-28	medium	nw-protection-portal.com/	NatWest Personal Banking
2025-04-28	medium	nw-protection-portal.com/	NatWest Personal Banking
2025-04-28	medium	nw-protection-portal.com/Login.php	NatWest Personal Banking
2025-04-28	medium	nw-protection-portal.com/	NatWest Personal Banking
2025-04-28	medium	nw-protection-portal.com/	NatWest Personal Banking
2025-04-28	medium	nw-protection-portal.com/	NatWest Personal Banking
2025-04-28	medium	nw-protection-portal.com/	NatWest Personal Banking
2025-04-28	medium	nw-protection-portal.com/	NatWest Personal Banking
2025-04-28	medium	nw-protection-portal.com/	NatWest Personal Banking

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (2)

	URL	From	Size	First Seen	Last Seen
	nw-protection-portal.com/Login.php	ScriptElement	5.8 kB	2023-03-08	2025-04-29
Pretty URL nw-protection-portal.com/Login.php IP 83.222.191.208 ASN #212283 Roza Holidays Eood Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-08 01:33 Last Seen2025-04-29 10:53 Times Seen45 Hash 3b309dca7b1a039c93d87274552b7e73 da255704c9960f139975c23a4b24a3e6a7a95169 39226b741db27afcad29bbdb1852ac321be34d090c46dd020e33249abd9d32fe Loading...

	nw-protection-portal.com/files/js/jquery.js	ScriptElement	272 kB	2023-03-07	2025-05-13
Pretty URL nw-protection-portal.com/files/js/jquery.js IP 83.222.191.208 ASN #212283 Roza Holidays Eood Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03 Last Seen2025-05-13 14:46 Times Seen1276 Hash 2ac898daf1837381b1264cdb792319ba 532496df4622a43699ee57b612180a21aedad065 84086bb634fc6fd223918894c6b74641811e06e84007937c5809942b7a02ddff Loading...

HTTP Transactions (18)

URL IP Response Size

nw-protection-portal.com/files/css/master.css

83.222.191.208

200 OK

244 kB

URL GET
nw-protection-portal.com/files/css/master.css
IP
83.222.191.208:443
ASN
#212283 Roza Holidays Eood

Requested by
https://nw-protection-portal.com/Login.php
Certificate
IssuerLet's Encrypt
Subjectnw-protection-portal.com
Fingerprint22:D4:A0:CF:BB:E2:48:62:12:04:61:8D:EB:7D:A1:7E:A4:80:07:A3
ValidityMon, 28 Apr 2025 12:59:12 GMT - Sun, 27 Jul 2025 12:59:11 GMT

File type
ASCII text, with very long lines (472), with CRLF line terminators
Size
244 kB (243837 bytes)
Hash
31173ab1d8254920778a641399b86190
4ae50e7b9712f67fee172bb8ad73bc6e1164b089
b219825ac314d72c5e00b184dc8a4216a2fded34a5259ec133d3bc6fd8a11260

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	NatWest Personal Banking

HTTP Headers

GET /files/css/master.css HTTP/1.1
Host: nw-protection-portal.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nw-protection-portal.com/Login.php
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 28 Apr 2025 23:28:54 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Last-Modified: Thu, 20 Aug 2020 02:50:10 GMT
Content-Encoding: gzip

nw-protection-portal.com/files/img/nw-security-banner-vishing-194x443.gif

83.222.191.208

200 OK

14 kB

URL GET
nw-protection-portal.com/files/img/nw-security-banner-vishing-194x443.gif
IP
83.222.191.208:443
ASN
#212283 Roza Holidays Eood

Requested by
https://nw-protection-portal.com/Login.php
Certificate
IssuerLet's Encrypt
Subjectnw-protection-portal.com
Fingerprint22:D4:A0:CF:BB:E2:48:62:12:04:61:8D:EB:7D:A1:7E:A4:80:07:A3
ValidityMon, 28 Apr 2025 12:59:12 GMT - Sun, 27 Jul 2025 12:59:11 GMT

File type
GIF image data, version 89a, 198 x 446
Size
14 kB (14375 bytes)
Hash
edc2c6f69e6b45711579e9b7a083c68c
c5ce264d9fd61c2f9ac2865aea44b0f1b4a86464
1aea65aeda4e39957158bacd84556ed7a77ab468265e2a163265b346b7f60965

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - NatWest
OpenPhish	phishing	NatWest Personal Banking

HTTP Headers

GET /files/img/nw-security-banner-vishing-194x443.gif HTTP/1.1
Host: nw-protection-portal.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nw-protection-portal.com/Login.php
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 28 Apr 2025 23:28:54 GMT
Content-Type: image/gif
Content-Length: 14375
Connection: keep-alive
Last-Modified: Wed, 19 Aug 2020 21:29:40 GMT
Accept-Ranges: bytes

nw-protection-portal.com/files/img/down-chevron.png

83.222.191.208

200 OK

295 B

URL GET
nw-protection-portal.com/files/img/down-chevron.png
IP
83.222.191.208:443
ASN
#212283 Roza Holidays Eood

Requested by
https://nw-protection-portal.com/Login.php
Certificate
IssuerLet's Encrypt
Subjectnw-protection-portal.com
Fingerprint22:D4:A0:CF:BB:E2:48:62:12:04:61:8D:EB:7D:A1:7E:A4:80:07:A3
ValidityMon, 28 Apr 2025 12:59:12 GMT - Sun, 27 Jul 2025 12:59:11 GMT

File type
PNG image data, 13 x 8, 8-bit/color RGBA, non-interlaced
Size
295 B (295 bytes)
Hash
5d1201e574de6bb2d10db83ade0d098d
b28bb6abd4cf048f7cebe0ee459c3511c0a22df7
4f5a022467e927b5b385cc335e58434a49bad0520ed018fc059075069d695c79

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - NatWest
OpenPhish	phishing	NatWest Personal Banking

HTTP Headers

GET /files/img/down-chevron.png HTTP/1.1
Host: nw-protection-portal.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nw-protection-portal.com/files/css/npc.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 28 Apr 2025 23:28:54 GMT
Content-Type: image/png
Content-Length: 295
Connection: keep-alive
Last-Modified: Wed, 19 Aug 2020 22:20:20 GMT
Accept-Ranges: bytes

nw-protection-portal.com/files/css/npc.css

83.222.191.208

200 OK

51 kB

URL GET
nw-protection-portal.com/files/css/npc.css
IP
83.222.191.208:443
ASN
#212283 Roza Holidays Eood

Requested by
https://nw-protection-portal.com/Login.php
Certificate
IssuerLet's Encrypt
Subjectnw-protection-portal.com
Fingerprint22:D4:A0:CF:BB:E2:48:62:12:04:61:8D:EB:7D:A1:7E:A4:80:07:A3
ValidityMon, 28 Apr 2025 12:59:12 GMT - Sun, 27 Jul 2025 12:59:11 GMT

File type
ASCII text, with very long lines (518), with CRLF line terminators
Size
51 kB (50960 bytes)
Hash
b1e3d4c1f5664bc223133b18c724ee8a
f9506abe9d2588e8242fdf8372dd745178241cfa
e6d03fb291fdf6036e3e04726f771d360b19353c35f10549b263e50e1f07a420

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - NatWest
OpenPhish	phishing	NatWest Personal Banking

HTTP Headers

GET /files/css/npc.css HTTP/1.1
Host: nw-protection-portal.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nw-protection-portal.com/Login.php
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 28 Apr 2025 23:28:54 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Last-Modified: Thu, 20 Aug 2020 02:50:04 GMT
Content-Encoding: gzip

nw-protection-portal.com/files/images/li5_outer_frame_top_curve.gif

83.222.191.208

404 Not Found

315 B

URL GET
nw-protection-portal.com/files/images/li5_outer_frame_top_curve.gif
IP
83.222.191.208:443
ASN
#212283 Roza Holidays Eood

Requested by
https://nw-protection-portal.com/Login.php
Certificate
IssuerLet's Encrypt
Subjectnw-protection-portal.com
Fingerprint22:D4:A0:CF:BB:E2:48:62:12:04:61:8D:EB:7D:A1:7E:A4:80:07:A3
ValidityMon, 28 Apr 2025 12:59:12 GMT - Sun, 27 Jul 2025 12:59:11 GMT

File type
HTML document, ASCII text
Size
315 B (315 bytes)
Hash
a34ac19f4afae63adc5d2f7bc970c07f
a82190fc530c265aa40a045c21770d967f4767b8
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - NatWest
OpenPhish	phishing	NatWest Personal Banking

HTTP Headers

GET /files/images/li5_outer_frame_top_curve.gif HTTP/1.1
Host: nw-protection-portal.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nw-protection-portal.com/files/css/master.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Server: nginx
Date: Mon, 28 Apr 2025 23:28:54 GMT
Content-Type: text/html; charset=iso-8859-1
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip

nw-protection-portal.com/files/img/radio-normal.png

83.222.191.208

200 OK

1.3 kB

URL GET
nw-protection-portal.com/files/img/radio-normal.png
IP
83.222.191.208:443
ASN
#212283 Roza Holidays Eood

Requested by
https://nw-protection-portal.com/Login.php
Certificate
IssuerLet's Encrypt
Subjectnw-protection-portal.com
Fingerprint22:D4:A0:CF:BB:E2:48:62:12:04:61:8D:EB:7D:A1:7E:A4:80:07:A3
ValidityMon, 28 Apr 2025 12:59:12 GMT - Sun, 27 Jul 2025 12:59:11 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, interlaced
Size
1.3 kB (1317 bytes)
Hash
e2dc7e58fe2e02e222d3a14b1fc5650d
580597e94f267ea7f868f5302839287f393a05dc
1ec277d20cb0b2b9d72322f3cc32d988435978a6a8f72b28e0f8ac8b1bf17a72

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - NatWest
OpenPhish	phishing	NatWest Personal Banking

HTTP Headers

GET /files/img/radio-normal.png HTTP/1.1
Host: nw-protection-portal.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nw-protection-portal.com/files/css/npc.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 28 Apr 2025 23:28:54 GMT
Content-Type: image/png
Content-Length: 1317
Connection: keep-alive
Last-Modified: Wed, 19 Aug 2020 21:43:46 GMT
Accept-Ranges: bytes

nw-protection-portal.com/files/img/check-box.png

83.222.191.208

200 OK

157 B

URL GET
nw-protection-portal.com/files/img/check-box.png
IP
83.222.191.208:443
ASN
#212283 Roza Holidays Eood

Requested by
https://nw-protection-portal.com/Login.php
Certificate
IssuerLet's Encrypt
Subjectnw-protection-portal.com
Fingerprint22:D4:A0:CF:BB:E2:48:62:12:04:61:8D:EB:7D:A1:7E:A4:80:07:A3
ValidityMon, 28 Apr 2025 12:59:12 GMT - Sun, 27 Jul 2025 12:59:11 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
157 B (157 bytes)
Hash
b23db76451b3df600c7dbda6c93a2e2e
a2054da2c842bf4f5651c4ee1481688e215a56bf
d2955b58d801a021737f025d1716a68fd2a143ddac3e0b749fcc053deba6e082

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - NatWest
OpenPhish	phishing	NatWest Personal Banking

HTTP Headers

GET /files/img/check-box.png HTTP/1.1
Host: nw-protection-portal.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nw-protection-portal.com/files/css/npc.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 28 Apr 2025 23:28:54 GMT
Content-Type: image/png
Content-Length: 157
Connection: keep-alive
Last-Modified: Wed, 19 Aug 2020 21:48:00 GMT
Accept-Ranges: bytes

nw-protection-portal.com/files/img/FSCS_Protected_Logo.png

83.222.191.208

200 OK

5.7 kB

URL GET
nw-protection-portal.com/files/img/FSCS_Protected_Logo.png
IP
83.222.191.208:443
ASN
#212283 Roza Holidays Eood

Requested by
https://nw-protection-portal.com/Login.php
Certificate
IssuerLet's Encrypt
Subjectnw-protection-portal.com
Fingerprint22:D4:A0:CF:BB:E2:48:62:12:04:61:8D:EB:7D:A1:7E:A4:80:07:A3
ValidityMon, 28 Apr 2025 12:59:12 GMT - Sun, 27 Jul 2025 12:59:11 GMT

File type
PNG image data, 80 x 106, 8-bit/color RGBA, non-interlaced
Size
5.7 kB (5679 bytes)
Hash
cce808c0c23f731523eb4b7298ad18d8
e7e040afc91e194b3241653aab4863bf20020014
f2b557317fb851b3ed73c2d8203192e9ed433bd006ca5025ccb3317ef15e1b8d

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - NatWest
OpenPhish	phishing	NatWest Personal Banking

HTTP Headers

GET /files/img/FSCS_Protected_Logo.png HTTP/1.1
Host: nw-protection-portal.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nw-protection-portal.com/Login.php
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 28 Apr 2025 23:28:54 GMT
Content-Type: image/png
Content-Length: 5679
Connection: keep-alive
Last-Modified: Wed, 19 Aug 2020 21:29:40 GMT
Accept-Ranges: bytes

nw-protection-portal.com/files/img/error-marker.png

83.222.191.208

200 OK

1.1 kB

URL GET
nw-protection-portal.com/files/img/error-marker.png
IP
83.222.191.208:443
ASN
#212283 Roza Holidays Eood

Requested by
https://nw-protection-portal.com/Login.php
Certificate
IssuerLet's Encrypt
Subjectnw-protection-portal.com
Fingerprint22:D4:A0:CF:BB:E2:48:62:12:04:61:8D:EB:7D:A1:7E:A4:80:07:A3
ValidityMon, 28 Apr 2025 12:59:12 GMT - Sun, 27 Jul 2025 12:59:11 GMT

File type
PNG image data, 29 x 29, 8-bit/color RGBA, non-interlaced
Size
1.1 kB (1090 bytes)
Hash
50f1540b40bf348f927c3ed21aba72b3
b8c94013139462b49a2422ba947a7a8fede3552e
27f324f2ad60091d5e8f76adfef83f9122dc8aa8df29d0a8d970bfe06aaa5005

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - NatWest
OpenPhish	phishing	NatWest Personal Banking

HTTP Headers

GET /files/img/error-marker.png HTTP/1.1
Host: nw-protection-portal.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nw-protection-portal.com/Login.php
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 28 Apr 2025 23:28:54 GMT
Content-Type: image/png
Content-Length: 1090
Connection: keep-alive
Last-Modified: Wed, 19 Aug 2020 21:29:40 GMT
Accept-Ranges: bytes

nw-protection-portal.com/files/img/white-lock.png

83.222.191.208

200 OK

285 B

URL GET
nw-protection-portal.com/files/img/white-lock.png
IP
83.222.191.208:443
ASN
#212283 Roza Holidays Eood

Requested by
https://nw-protection-portal.com/Login.php
Certificate
IssuerLet's Encrypt
Subjectnw-protection-portal.com
Fingerprint22:D4:A0:CF:BB:E2:48:62:12:04:61:8D:EB:7D:A1:7E:A4:80:07:A3
ValidityMon, 28 Apr 2025 12:59:12 GMT - Sun, 27 Jul 2025 12:59:11 GMT

File type
PNG image data, 18 x 22, 8-bit/color RGBA, non-interlaced
Size
285 B (285 bytes)
Hash
4a3360fb538fcc33db66e22afbd18715
112eca49dcfede70854283a7c51fba6e8a96a4df
b465d00b89619e9899ec7d618559157db09f935d318466d67deb036157fadcf2

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - NatWest
OpenPhish	phishing	NatWest Personal Banking

HTTP Headers

GET /files/img/white-lock.png HTTP/1.1
Host: nw-protection-portal.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nw-protection-portal.com/files/css/npc.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 28 Apr 2025 23:28:54 GMT
Content-Type: image/png
Content-Length: 285
Connection: keep-alive
Last-Modified: Wed, 19 Aug 2020 21:40:48 GMT
Accept-Ranges: bytes

nw-protection-portal.com/files/img/favicon.ico

83.222.191.208

200 OK

2.2 kB

URL GET
nw-protection-portal.com/files/img/favicon.ico
IP
83.222.191.208:443
ASN
#212283 Roza Holidays Eood

Requested by
https://nw-protection-portal.com/Login.php
Certificate
IssuerLet's Encrypt
Subjectnw-protection-portal.com
Fingerprint22:D4:A0:CF:BB:E2:48:62:12:04:61:8D:EB:7D:A1:7E:A4:80:07:A3
ValidityMon, 28 Apr 2025 12:59:12 GMT - Sun, 27 Jul 2025 12:59:11 GMT

File type
MS Windows icon resource - 1 icon, 32x32, 8 bits/pixel
Size
2.2 kB (2238 bytes)
Hash
d0ab1861f850d4514edaa1696b3b5ce2
8fbdfef1335ccf858072297caef21e1925a44d11
9bbf91204e8022d01c859c92c1d9218ac4859de521548856534b48ac2e7849a8

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - NatWest
OpenPhish	phishing	NatWest Personal Banking

HTTP Headers

GET /files/img/favicon.ico HTTP/1.1
Host: nw-protection-portal.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nw-protection-portal.com/Login.php
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 28 Apr 2025 23:28:54 GMT
Content-Type: image/x-icon
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Last-Modified: Wed, 19 Aug 2020 21:50:12 GMT
Content-Encoding: gzip

nw-protection-portal.com/Login.php

83.222.191.208

200 OK

248 kB

URL User Request GET
nw-protection-portal.com/Login.php
IP
83.222.191.208:443
ASN
#212283 Roza Holidays Eood

Certificate
IssuerLet's Encrypt
Subjectnw-protection-portal.com
Fingerprint22:D4:A0:CF:BB:E2:48:62:12:04:61:8D:EB:7D:A1:7E:A4:80:07:A3
ValidityMon, 28 Apr 2025 12:59:12 GMT - Sun, 27 Jul 2025 12:59:11 GMT

File type
HTML document, ASCII text, with very long lines (8164)
Size
248 kB (248078 bytes)
Hash
5166196c123c2bd48222f3ff167db804
0ebfe793edaf4c9cfae520c2298c89a097ec2769
35776a92459476d75a93e5202eae40e1d57ff08c33a1e66a29a37b69b9a70e5d

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	NatWest Personal Banking

HTTP Headers

GET /Login.php HTTP/1.1
Host: nw-protection-portal.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 28 Apr 2025 23:28:53 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip

nw-protection-portal.com/files/css/overlayPromptMaster.css

83.222.191.208

200 OK

1.4 kB

URL GET
nw-protection-portal.com/files/css/overlayPromptMaster.css
IP
83.222.191.208:443
ASN
#212283 Roza Holidays Eood

Requested by
https://nw-protection-portal.com/Login.php
Certificate
IssuerLet's Encrypt
Subjectnw-protection-portal.com
Fingerprint22:D4:A0:CF:BB:E2:48:62:12:04:61:8D:EB:7D:A1:7E:A4:80:07:A3
ValidityMon, 28 Apr 2025 12:59:12 GMT - Sun, 27 Jul 2025 12:59:11 GMT

File type
ASCII text, with CRLF line terminators
Size
1.4 kB (1378 bytes)
Hash
1e4c183b3f098d3bca4ccce20c428912
15b417b5fc9ac2e762e5aa7995c68e54187f372f
42e70c32efffee33a1d8bddf152d6b754fa8abb83c6166444b8d41b217d9dae6

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - NatWest
OpenPhish	phishing	NatWest Personal Banking

HTTP Headers

GET /files/css/overlayPromptMaster.css HTTP/1.1
Host: nw-protection-portal.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nw-protection-portal.com/Login.php
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 28 Apr 2025 23:28:54 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Last-Modified: Wed, 19 Aug 2020 21:29:34 GMT
Content-Encoding: gzip

nw-protection-portal.com/files/css/overlayPrompt.css

83.222.191.208

200 OK

76 B

URL GET
nw-protection-portal.com/files/css/overlayPrompt.css
IP
83.222.191.208:443
ASN
#212283 Roza Holidays Eood

Requested by
https://nw-protection-portal.com/Login.php
Certificate
IssuerLet's Encrypt
Subjectnw-protection-portal.com
Fingerprint22:D4:A0:CF:BB:E2:48:62:12:04:61:8D:EB:7D:A1:7E:A4:80:07:A3
ValidityMon, 28 Apr 2025 12:59:12 GMT - Sun, 27 Jul 2025 12:59:11 GMT

File type
ASCII text, with CRLF line terminators
Size
76 B (76 bytes)
Hash
82a1b6373fa17d314053cb7173954338
7e2ba5b991ccf1c31c1f1070f74124bc30a1f97d
ef7db794b4a6b5c42d2535919d91fb11da1e5cd1147f35196db382197b35fdee

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - NatWest
OpenPhish	phishing	NatWest Personal Banking

HTTP Headers

GET /files/css/overlayPrompt.css HTTP/1.1
Host: nw-protection-portal.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nw-protection-portal.com/Login.php
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 28 Apr 2025 23:28:54 GMT
Content-Type: text/css
Content-Length: 76
Connection: keep-alive
Last-Modified: Wed, 19 Aug 2020 21:29:34 GMT
Accept-Ranges: bytes

nw-protection-portal.com/files/img/n-w-logo.svg

83.222.191.208

200 OK

4.9 kB

URL GET
nw-protection-portal.com/files/img/n-w-logo.svg
IP
83.222.191.208:443
ASN
#212283 Roza Holidays Eood

Requested by
https://nw-protection-portal.com/Login.php
Certificate
IssuerLet's Encrypt
Subjectnw-protection-portal.com
Fingerprint22:D4:A0:CF:BB:E2:48:62:12:04:61:8D:EB:7D:A1:7E:A4:80:07:A3
ValidityMon, 28 Apr 2025 12:59:12 GMT - Sun, 27 Jul 2025 12:59:11 GMT

File type
SVG Scalable Vector Graphics image
Size
4.9 kB (4874 bytes)
Hash
b186959f9358ac5b56af56ca19aaeea8
eb4c97625a600ba6cae3e3565536c85949f09eb8
668faa210a0e0cabb9aa13a1a6ad4e3b22b0f9cad90c43694ba37a8a4714b0e6

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - NatWest
OpenPhish	phishing	NatWest Personal Banking

HTTP Headers

GET /files/img/n-w-logo.svg HTTP/1.1
Host: nw-protection-portal.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nw-protection-portal.com/Login.php
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 28 Apr 2025 23:28:54 GMT
Content-Type: image/svg+xml
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Last-Modified: Wed, 19 Aug 2020 21:41:22 GMT
Content-Encoding: gzip

nw-protection-portal.com/files/js/jquery.js

83.222.191.208

200 OK

272 kB

URL GET
nw-protection-portal.com/files/js/jquery.js
IP
83.222.191.208:443
ASN
#212283 Roza Holidays Eood

Requested by
https://nw-protection-portal.com/Login.php
Certificate
IssuerLet's Encrypt
Subjectnw-protection-portal.com
Fingerprint22:D4:A0:CF:BB:E2:48:62:12:04:61:8D:EB:7D:A1:7E:A4:80:07:A3
ValidityMon, 28 Apr 2025 12:59:12 GMT - Sun, 27 Jul 2025 12:59:11 GMT

File type
JavaScript source, ASCII text, with CRLF line terminators
Size
272 kB (272153 bytes)
Hash
2ac898daf1837381b1264cdb792319ba
532496df4622a43699ee57b612180a21aedad065
84086bb634fc6fd223918894c6b74641811e06e84007937c5809942b7a02ddff

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - NatWest
OpenPhish	phishing	NatWest Personal Banking

HTTP Headers

GET /files/js/jquery.js HTTP/1.1
Host: nw-protection-portal.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nw-protection-portal.com/Login.php
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 28 Apr 2025 23:28:54 GMT
Content-Type: text/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Last-Modified: Sat, 24 Aug 2019 13:25:18 GMT
Content-Encoding: gzip

nw-protection-portal.com/files/img/combined-shape.png

83.222.191.208

200 OK

359 B

URL GET
nw-protection-portal.com/files/img/combined-shape.png
IP
83.222.191.208:443
ASN
#212283 Roza Holidays Eood

Requested by
https://nw-protection-portal.com/Login.php
Certificate
IssuerLet's Encrypt
Subjectnw-protection-portal.com
Fingerprint22:D4:A0:CF:BB:E2:48:62:12:04:61:8D:EB:7D:A1:7E:A4:80:07:A3
ValidityMon, 28 Apr 2025 12:59:12 GMT - Sun, 27 Jul 2025 12:59:11 GMT

File type
PNG image data, 13 x 13, 8-bit/color RGBA, non-interlaced
Size
359 B (359 bytes)
Hash
3d738a237a2dd5f3075939942052d472
9ccba64b7bcd8a7949b3afbcfa0d76a7bf47618e
d1c878b4e69d9da5292c53b1f46708de74c435144895bdfd697208406466a814

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - NatWest
OpenPhish	phishing	NatWest Personal Banking

HTTP Headers

GET /files/img/combined-shape.png HTTP/1.1
Host: nw-protection-portal.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nw-protection-portal.com/files/css/npc.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 28 Apr 2025 23:28:54 GMT
Content-Type: image/png
Content-Length: 359
Connection: keep-alive
Last-Modified: Wed, 19 Aug 2020 23:51:30 GMT
Accept-Ranges: bytes

nw-protection-portal.com/files/fonts/RNHouseSansW05-Regular.woff2

83.222.191.208

200 OK

22 kB

URL GET
nw-protection-portal.com/files/fonts/RNHouseSansW05-Regular.woff2
IP
83.222.191.208:443
ASN
#212283 Roza Holidays Eood

Requested by
https://nw-protection-portal.com/Login.php
Certificate
IssuerLet's Encrypt
Subjectnw-protection-portal.com
Fingerprint22:D4:A0:CF:BB:E2:48:62:12:04:61:8D:EB:7D:A1:7E:A4:80:07:A3
ValidityMon, 28 Apr 2025 12:59:12 GMT - Sun, 27 Jul 2025 12:59:11 GMT

File type
Web Open Font Format (Version 2), TrueType, length 21572, version 1.65
Size
22 kB (21572 bytes)
Hash
4b04fa8e8cb9b74a12575a0fd3e8f1ac
2f58dcbfc01528ef4b4c7e395dde7ba3ea738cef
9be8b2c42ad2d6f7327f62a7d03995a5a4615770154941d59493473186e5140c

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - NatWest
OpenPhish	phishing	NatWest Personal Banking

HTTP Headers

GET /files/fonts/RNHouseSansW05-Regular.woff2 HTTP/1.1
Host: nw-protection-portal.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://nw-protection-portal.com/files/css/master.css
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 28 Apr 2025 23:28:54 GMT
Content-Type: font/woff2
Content-Length: 21572
Connection: keep-alive
Last-Modified: Wed, 19 Aug 2020 21:30:10 GMT
Accept-Ranges: bytes

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

JavaScript (2)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (18)

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET

IP

ASN