Verdict
nab.com.au appears legitimate.
Our checks found nothing pointing to fraud. Ordinary care still applies when you pay or sign in.
| What this site appears to be | GPT summary status=degraded | GPT summary call failed: HTTP error from GPT: 429 Too Many Requests { "error": { "message": "You exceeded your current quota, please check your plan and billing details. For more information on this error, read the docs: https://platform.openai.com/docs/guides/error-codes/api-errors.", "type": "insufficient_quota", "param": null, "code": "insufficient_quota" } } |
|---|
Evidence status and limitations
Evidence completeness: UNKNOWN
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | None flagged itVirusTotal | Clear |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0 reportsAbuseIPDB; shared hosting inflates this count | Noted |
| Domain age | Not availableNo registration record was returned | Noted |
| Web archive | Never archivedNo public history of this site | Watch |
| Certificate | Encrypted connectionIssued by DigiCert EV RSA CA G2 | Noted |
The page as captured
No screenshot is retained for this report.
Key findings
- Automated classification: Not Scam.
- No flags from the reputation services TrustSniffer consulted at assessment time.
Full analysis
Overview
This website is the National Australia Bank personal-banking portal, presenting loans, accounts, credit cards, and insurance services for visitors seeking mainstream retail banking products.
Scam/Impersonation Risk
No phishing, impersonation, blacklist, or other identity contradiction was observed. External reputation results were clean, and interaction testing did not identify wallet connections, credential-exfiltration forms, clipboard manipulation, wallet-draining behavior, or cloaking. The homepage did generate substantial external network activity and significant DOM changes after interaction; these are technical behaviors worth understanding in a financial application, but they were not accompanied by confirmed malicious mechanisms and do not override the high-trust determination.
- External reputation checks recorded 0 malicious detections, 0 suspicious detections, and no Google Safe Browsing malicious result for the homepage domain.
- Homepage interaction testing recorded 24 external XHR requests, including 12 non-whitelisted XHR requests, and 18 external POST requests, including 12 non-whitelisted POST requests.
- Interaction testing recorded 3,381 maximum DOM changes; wallet-connect runs, wallet-sensitive runs, wallet-drainer runs, hidden forms, password-external forms, clipboard writes, and cloaking events were all recorded as 0 or absent.
- The domain had a Tranco traffic rank of 14524 and was within the top 1,000,000 domains.
Regulatory Verification Notes
Available evidence is consistent with an established institutional banking website, but the real-world operator identity is not independently verified. Registration artifacts identify National Australia Bank Limited as the owner and Corporation Service Company (Aust) Pty Ltd as registrar, while the transport certificate carries the same institutional subject name; these signals support apparent identity consistency without proving control of the website. The supplied material does not establish an applicable banking license or registration through an independent regulatory source, so authorization and disclosure remain matters for ordinary confirmation rather than evidence of a scam. No matching third-party broker signal was identified.
- Registration records list the owner as National Australia Bank Limited and the registrar as Corporation Service Company (Aust) Pty Ltd.
- The homepage’s transport encryption uses an EV certificate issued by DigiCert EV RSA CA G2 for National Australia Bank Limited, valid to 2027-01-13T23:59:59+00:00.
- The captured homepage returned HTTP status 200 and contained 17,834 characters of page text.
- The relevant third-party broker dataset returned no match.
What to Verify Next
Before credential or payment-sensitive interactions, independently confirm that the domain and institutional identity match details obtained from an official offline or separately sourced channel. Applicable banking authorization should be checked with the relevant regulatory registry, and any merchant-facing payment flow should be assessed for the counterparty’s identity, return terms, and available payment protections. Official support and contact channels should also be confirmed through an independently sourced institutional channel.
- Independent identity check: compare the domain and certificate subject with institution details obtained from a separately sourced official channel.
- Regulatory check: confirm the applicable authorization or registration with the relevant banking regulator.
- Transaction check: for any payment involving a third party, confirm counterparty identity, return conditions, and payment-protection arrangements before proceeding.
Summary Verdict
The website presents a high-trust, low-risk posture and is apparently legitimate on the available evidence, with no observed contradiction or malicious reputation signal. The conclusion is evidence-consistent rather than proof of the real-world operator’s identity, which remains independently unverified.
Infrastructure Integrity
The site is served through Akamai International B.V. infrastructure, providing established edge-delivery capability. This is a mitigating infrastructure signal, not independent proof of legitimacy or operator control.
- Served from AS20940 (AKAMAI-ASN1 - Akamai International B.V., NL), observed server IP 2.21.240.7.
Closing Assessment
Normal use is proportionate to the assessment, subject to independent identity confirmation and standard payment-protection checks before submitting credentials or initiating payment-sensitive actions.
Written analysis generated 2026-08-11 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
No rule findings contributed to this verdict.
Identity verification
| Status | UNKNOWN |
|---|---|
| Identity score | 50/100 |
| Identity verification confidence | 30% |
- AI page analysis unavailable (page captured; identity not AI-verified)
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of nab.com.au.
- The request stayed on nab.com.au. It was not redirected to another domain. Clear
- Registration is published under Corporation Service Company (Aust) Pty Ltd. Clear
- DNS for this domain is served by com.au, across 2 name servers. Noted
- It is hosted on AKAMAI-ASN1, from a server in NL. Noted
Domain intelligence
| Registrar | Corporation Service Company (Aust) Pty Ltd |
|---|---|
| Hosting | AKAMAI-ASN1 - Akamai International B.V., NL |
| Country | NL |
| Server IP | 2.21.240.7 |
| Name servers | ns1.national.com.au, ns2.national.com.au |
| SSL issuer | DigiCert EV RSA CA G2 |
| SSL expiry | 2027-01-13 |
| Domain age | Not available (no registration date was returned) |
| Domain expiry | Not available |
| Archive first seen | Not available |
| Archive snapshots | 0 |
| Reputation | VirusTotal: 0 flagged | AbuseIPDB: 0 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about nab.com.au at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.