www.secure.bnz.co.nz.valuri.com.br
Open in
urlscan Pro
162.241.135.91
Malicious Activity!
Public Scan
URL:
https://www.secure.bnz.co.nz.valuri.com.br/
Submission: On June 11 via automatic, source openphish
Submission: On June 11 via automatic, source openphish
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 20 HTTP transactions.
The main IP is 162.241.135.91, located in
United States and
belongs to UNIFIEDLAYER-AS-1, US.
The main domain is www.secure.bnz.co.nz.valuri.com.br.
TLS certificate: Issued by R3 on June 10th 2021. Valid for: 3 months.
This is the only time www.secure.bnz.co.nz.valuri.com.br was scanned on urlscan.io!
TLS certificate: Issued by R3 on June 10th 2021. Valid for: 3 months.
This is the only time www.secure.bnz.co.nz.valuri.com.br was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: BNZ Bank (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 19 | 162.241.135.91 162.241.135.91 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
| 1 | 2a00:1450:400... 2a00:1450:400d:809::2001 | 15169 (GOOGLE) (GOOGLE) | |
| 20 | 2 |
19
162.241.135.91
(United States)
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: vps.rsgtecnologia.com.br
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: vps.rsgtecnologia.com.br
| www.secure.bnz.co.nz.valuri.com.br |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 19 |
valuri.com.br
www.secure.bnz.co.nz.valuri.com.br |
439 KB |
| 1 |
blogspot.com
xpagess.blogspot.com |
|
| 20 | 2 |
| Domain | Requested by | |
|---|---|---|
| 19 | www.secure.bnz.co.nz.valuri.com.br |
www.secure.bnz.co.nz.valuri.com.br
|
| 1 | xpagess.blogspot.com |
www.secure.bnz.co.nz.valuri.com.br
|
| 20 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.bnz.co.nz |
| secure.bnz.co.nz |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| secure.bnz.co.nz.valuri.com.br R3 |
2021-06-10 - 2021-09-08 |
3 months | crt.sh |
| misc-sni.blogspot.com GTS CA 1C3 |
2021-05-17 - 2021-08-09 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.secure.bnz.co.nz.valuri.com.br/
Frame ID: 536D4F55FB4E31237FFBEF2456901A7E
Requests: 20 HTTP requests in this frame
7 Outgoing links
These are links going to different origins than the main page.
URL: https://www.bnz.co.nz/
Title: BNZ Logo
Title: BNZ Logo
Search URL Search Domain Scan URL
URL: https://secure.bnz.co.nz/auth/personal-login
Title: Current PagePersonal Banking
Title: Current PagePersonal Banking
Search URL Search Domain Scan URL
URL: https://www.bnz.co.nz/registration/ib/app/register
Title: Register
Title: Register
Search URL Search Domain Scan URL
URL: https://www.bnz.co.nz/registration/ib/app/resetPassword
Title: Forgot password?
Title: Forgot password?
Search URL Search Domain Scan URL
URL: https://www.bnz.co.nz/iphoneapp
Search URL Search Domain Scan URL
URL: https://www.bnz.co.nz/androidapp
Search URL Search Domain Scan URL
URL: https://www.bnz.co.nz/personal-banking/everyday-banking/mobile-banking
Title: Learn more about the app
Title: Learn more about the app
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
20 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
www.secure.bnz.co.nz.valuri.com.br/ |
42 KB 42 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
f.txt
www.secure.bnz.co.nz.valuri.com.br/BNZ%20Login_files/ |
175 KB 176 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
1581098295914
www.secure.bnz.co.nz.valuri.com.br/BNZ%20Login_files/ |
50 KB 50 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
c0b52ff90d000139628464bd
www.secure.bnz.co.nz.valuri.com.br/BNZ%20Login_files/ |
87 B 115 B |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
serrano.css
www.secure.bnz.co.nz.valuri.com.br/BNZ%20Login_files/ |
2 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
logout.png
www.secure.bnz.co.nz.valuri.com.br/BNZ%20Login_files/ |
70 B 130 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
logout(1).png
www.secure.bnz.co.nz.valuri.com.br/BNZ%20Login_files/ |
70 B 122 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
app-store-badge.svg
www.secure.bnz.co.nz.valuri.com.br/BNZ%20Login_files/ |
9 KB 9 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
google-play-badge.svg
www.secure.bnz.co.nz.valuri.com.br/BNZ%20Login_files/ |
7 KB 7 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
c0b52ff90d000139628464bd(1)
www.secure.bnz.co.nz.valuri.com.br/BNZ%20Login_files/ |
9 KB 9 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
2.2e53916f.chunk.js.t%C3%A9l%C3%A9chargement
www.secure.bnz.co.nz.valuri.com.br/BNZ%20Login_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
main.69066654.chunk.js.t%C3%A9l%C3%A9chargement
www.secure.bnz.co.nz.valuri.com.br/BNZ%20Login_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
_Incapsula_Resource
www.secure.bnz.co.nz.valuri.com.br/BNZ%20Login_files/ |
141 KB 142 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
/
xpagess.blogspot.com/ |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
SerranoWeb-Bold.woff2
www.secure.bnz.co.nz.valuri.com.br/BNZ%20Login_files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
SerranoWeb-Regular.woff2
www.secure.bnz.co.nz.valuri.com.br/BNZ%20Login_files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
main.69066654.chunk.js.t%C3%A9l%C3%A9chargement
www.secure.bnz.co.nz.valuri.com.br/BNZ%20Login_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
SerranoWeb-Bold.woff
www.secure.bnz.co.nz.valuri.com.br/BNZ%20Login_files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
SerranoWeb-Regular.woff
www.secure.bnz.co.nz.valuri.com.br/BNZ%20Login_files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
_Incapsula_Resource
www.secure.bnz.co.nz.valuri.com.br/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
.png%22){kind=link}
.png){kind=link}
.png){kind=link}
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: BNZ Bank (Banking)32 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| webpackJsonp object| $jscomp object| com_sas_ci_acs object| c3 function| overridePrototypes object| Hashcode object| GeneralBase64 object| Base64 function| getDecisionParams object| spotMap function| loadDoc function| extractValue object| dataTagToEventMap function| handleInjectResponse function| windowFocused function| windowBlured function| LocalQueue object| CryptoJS function| onYouTubeIframeAPIReady function| onYouTubePlayerReady string| expires1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| www.secure.bnz.co.nz.valuri.com.br/ | Name: ___utmvc Value: VuJ3ZhGeN5o8LYVJ8UqNKtKY5KaL95yumVF8Iwr76Qms7jYUSrgkzFqf/1g1Nk4wBogiN3uY/i5sEia0AichbI8BCy37+zqvOiXuzY4hqW+d1MsvcgB0/LeVAOiOGGJCgB+CRZGV/72pBy3/g7223jN6wXLolqaJBe23K/lIhsYRxCCyc/jmCwPSRhu02QDYLihn4sg11J7FE1mtKce/KHYZ56bhXXprvPnH/t6+xCYcEx2YBjcLlhniSVXsu1IkJH4hUiM+e2Y8MurDPgJzXQqK4ezez0Co3tjDZpYb7qOCHYJSBTE6L1Uc2XFn0E1m+A3AMe8yQc66ntvqH3HB9F60anzSqiGAfYvFSiuZEtiQuWIbfmFA3zhmrHPMIvw/QShLGOLHvvKKeTJ2SY0QAt9G1g9YhW0Iaa3mpexpbLjWS3Y+2zi09Xwix2EZtSmRE+teHKr11t3RbUtdjw16n3HLPGvqZhI/MUB6Wvmm7hM8RoPBsAVMWMA869JNatmI3h/2waACAnMeVDoNMgnk0pYhzTlzTohmesN0oQbdLWOafRR3FujxmPDNCqGXbDTu+OjkaTOVeFziUtk7hJpcSwgouByPjLx9/l2b7UdjqvMgSzIRCyUmwGDNYU+i6AoOOCb0+sv04VqbXbsz0fplagWRayCSpdCgtqYMvchpqDFpsgLfCD+fJJOp1QoaOU/2Iiy1MEzH7UtsinNFq0ydP9VboxOFeOLcIE90uWqVs9pn3ELgFhipY4Xy2GZdNYgT5eRrZ+3y2A1xLpYBBQ/zK2DCfPPdgo56uM5/TqJ1jAOdK60ONxHeVydUlH3FLdhW1qbR9xd0UQhEBsaQ/4qGavQdwHb+QpDfjyZRWiJ59+kEMzohH4o7qsYJYEGGL85X9YzFrq5dVZ/D5HEgmvX+O/BUKBstK6jaSRMYVF7XfiIBsaN4svJHBxsy4gonM140zmKgm2UfOgb8ylyNnX68M9o4/+3bSJIJcUyMYiP22arTxXQTd+UpRG21AlsQ8s2e3zryQnpceiqBOC5QTO4JchWKa/JGUEHrFkiJOMudGQ60YlO12eTWXxSYqg73qInlV4/eYK4Fr1yaEjkysjr5erciNJeLSfk8EwqhL5nuDbbjIdRiUihMifgRsdV3avFnC7Zkl075/6/RBmlHwuUKW+hkt2/FjUFr/pjM+S0bJczk7yyFmQuM1BURUzOEnCxjDh28/a2xDl4nlJcPjpItbk/nYkgiVgnaHB2OMmMlVOWCaPVAWszbUXvRwMFCQ+OhAuP78WL9Yy3WYcEmt+0ZSyJe+aR9xOA8FJjlszy8jZBWrQmWZXsyHEb+Bnu8EvEiHmg/vWaZ7bnraPGEprPhbuyozkKlDziBIXafYNUJJsQK3He27c7Bdkatdk1QdIjzZZw5HxWm7dVI/Th138dsvfUTO8w8adkX7BR3QjFeBnCzAoH5A6/VxWTPUjaYKEzdPbAaBBZeB9LB0XxJpiK7CsefFcRV8UMmNZRbG77OCOXd1vZCFySnNahslxboIO3/6N2byqAORLf1i1m/6Jt1jhpQOq85x50h7tvQUAjZWlEtU9cL6TZSEVClw0PFb8c7U8Ce1ILCbOokwr4Yw8Ha4aQlOqLoi2gZds+ocyxkaWdlc3Q9LHM9TmFOTmFOTmFOTmFOTmFOTmFOTmFOTmFOTmFOTmFOTmFOTmFOTmFOTmFOTmFOTmFOTmFOTmFOTmFOTmFOTmFOTmFOTmFOTmFOTmFOTmFOTmFOTmFOTmFOTmFOTmFOTmFOTmFOTmFOTmFOTmFOTmFOTmFOTmFOTmFO |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
www.secure.bnz.co.nz.valuri.com.br
xpagess.blogspot.com
162.241.135.91
2a00:1450:400d:809::2001
01e02a02093340071d1364f08f71d9f2c62e272ba902bbc4a01bc505f693fc1e
0b75840d8233a55f3be131d3b25fb113bcc8d49ee6b1b568275d8f75a4328e99
119607ec59035aa84d05f83b163b75d622b9db0ed1c936a4cb6648a53813ca2c
16486af0d6e767efe863cdb81f3ae8a0f4cbbe0c03e5ab4f2b811051a109394a
299064307bdf097dba446f70967ff65c633ec32f992d41a52bb2d31c260a502e
39ceb9726ab5a1982f0b6d3167f97ecec34f29a1005dce26ea2e1225f10ba237
5aad7aef8991c5251a940c6657212b0e95a93472876115d6c87f075a63a93bfb
b26a5757777fb533b708716b39c90990843cca285507d753889c353538498232
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
dc5687b50f70cb95379bfced5a0eae768dd4382cd6b393ee77d65bbdd6373fbf
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f8260d7d44cfb1f8029f9a65067d76476106c2dbf95aab7673a51198ca6b9659