personal.bnz.co.ew.cloudns.nz
Open in
urlscan Pro
108.165.237.187
Malicious Activity!
Public Scan
Effective URL: https://personal.bnz.co.ew.cloudns.nz/kia-col/bank/Kiwibank/home.php?&CeXTsXRi3c8mqnFCiuWf2ubgOGJMknEIEaMcKUTAcTf0bUlkC4yoDmIWUDNqCEZX...
Submission: On December 20 via manual from AU — Scanned from NZ
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on December 19th 2023. Valid for: 3 months.
This is the only time personal.bnz.co.ew.cloudns.nz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Kiwibank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 18 | 108.165.237.187 108.165.237.187 | 23470 (RELIABLESITE) (RELIABLESITE) | |
2 | 13.54.222.143 13.54.222.143 | 16509 (AMAZON-02) (AMAZON-02) | |
2 | 2404:6800:400... 2404:6800:4006:80a::2008 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2404:6800:400... 2404:6800:4006:809::200e | 15169 (GOOGLE) (GOOGLE) | |
1 | 2404:6800:400... 2404:6800:4006:814::200e | 15169 (GOOGLE) (GOOGLE) | |
2 | 2404:6800:400... 2404:6800:4003:c1a::9a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2404:6800:400... 2404:6800:4006:810::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2404:6800:400... 2404:6800:4006:809::2004 | 15169 (GOOGLE) (GOOGLE) | |
29 | 8 |
ASN16509 (AMAZON-02, US)
PTR: ec2-13-54-222-143.ap-southeast-2.compute.amazonaws.com
www.images-home.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
18 |
cloudns.nz
1 redirects
personal.bnz.co.ew.cloudns.nz |
586 KB |
2 |
google.co.nz
www.google.co.nz — Cisco Umbrella Rank: 40936 |
515 B |
2 |
doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 75 |
418 B |
2 |
google.com
analytics.google.com — Cisco Umbrella Rank: 152 www.google.com — Cisco Umbrella Rank: 2 |
672 B |
2 |
google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 27 |
21 KB |
2 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 36 |
171 KB |
2 |
images-home.com
www.images-home.com — Cisco Umbrella Rank: 126575 |
1 KB |
29 | 7 |
Domain | Requested by | |
---|---|---|
18 | personal.bnz.co.ew.cloudns.nz |
1 redirects
personal.bnz.co.ew.cloudns.nz
|
2 | www.google.co.nz |
personal.bnz.co.ew.cloudns.nz
|
2 | stats.g.doubleclick.net |
www.googletagmanager.com
www.google-analytics.com |
2 | www.google-analytics.com |
www.googletagmanager.com
www.google-analytics.com |
2 | www.googletagmanager.com |
personal.bnz.co.ew.cloudns.nz
www.googletagmanager.com |
2 | www.images-home.com |
personal.bnz.co.ew.cloudns.nz
|
1 | www.google.com |
personal.bnz.co.ew.cloudns.nz
|
1 | analytics.google.com |
www.googletagmanager.com
|
29 | 8 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.kiwibank.co.nz |
Subject Issuer | Validity | Valid | |
---|---|---|---|
personal.bnz.co.ew.cloudns.nz Sectigo RSA Domain Validation Secure Server CA |
2023-12-19 - 2024-03-18 |
3 months | crt.sh |
images-home.com Amazon RSA 2048 M02 |
2023-09-06 - 2024-10-04 |
a year | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2023-11-20 - 2024-02-12 |
3 months | crt.sh |
*.google.com GTS CA 1C3 |
2023-11-20 - 2024-02-12 |
3 months | crt.sh |
*.g.doubleclick.net GTS CA 1C3 |
2023-11-20 - 2024-02-12 |
3 months | crt.sh |
*.google.co.nz GTS CA 1C3 |
2023-11-27 - 2024-02-19 |
3 months | crt.sh |
www.google.com GTS CA 1C3 |
2023-11-20 - 2024-02-12 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://personal.bnz.co.ew.cloudns.nz/kia-col/bank/Kiwibank/home.php?&CeXTsXRi3c8mqnFCiuWf2ubgOGJMknEIEaMcKUTAcTf0bUlkC4yoDmIWUDNqCEZX3IcMMH9UTq61Z8XkCtc6aEMasA2VqvbnWof252luIPCYlWQXJAF0HHonzzj5P188tg8vD9mWvnUfVOslcDWuZ1tMOPW84vy12iq1QU0rKsFMQwzhQf6gczrWLUa5az1PTqpoOEfe
Frame ID: 25AA7E95889C1DB5059AFF08BB89BF78
Requests: 29 HTTP requests in this frame
Screenshot
Page Title
Login - Kiwibank Internet BankingPage URL History Show full URLs
-
https://personal.bnz.co.ew.cloudns.nz/kia-col/bank/Kiwibank/
HTTP 302
https://personal.bnz.co.ew.cloudns.nz/kia-col/bank/Kiwibank/home.php?&CeXTsXRi3c8mqnFCiuWf2ubgOGJMknEIEaMcKUTAcTf0... Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Microsoft ASP.NET (Web Frameworks) Expand
Detected patterns
- <input[^>]+name="__VIEWSTATE
Google Analytics (Analytics) Expand
Detected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
Google Tag Manager (Tag Managers) Expand
Detected patterns
- googletagmanager\.com/ns\.html[^>]+></iframe>
- googletagmanager\.com/gtm\.js
- googletagmanager\.com/gtag/js
Page Statistics
6 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: More about internet banking
Search URL Search Domain Scan URL
Title: access number
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: Contact Us
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://personal.bnz.co.ew.cloudns.nz/kia-col/bank/Kiwibank/
HTTP 302
https://personal.bnz.co.ew.cloudns.nz/kia-col/bank/Kiwibank/home.php?&CeXTsXRi3c8mqnFCiuWf2ubgOGJMknEIEaMcKUTAcTf0bUlkC4yoDmIWUDNqCEZX3IcMMH9UTq61Z8XkCtc6aEMasA2VqvbnWof252luIPCYlWQXJAF0HHonzzj5P188tg8vD9mWvnUfVOslcDWuZ1tMOPW84vy12iq1QU0rKsFMQwzhQf6gczrWLUa5az1PTqpoOEfe Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
29 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
home.php
personal.bnz.co.ew.cloudns.nz/kia-col/bank/Kiwibank/ Redirect Chain
|
10 KB 10 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ruxitagentjs_ICA2Vfgjqru_10237220328075400.js
personal.bnz.co.ew.cloudns.nz/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
css.css
personal.bnz.co.ew.cloudns.nz/kia-col/bank/Kiwibank/index_files/ |
169 KB 169 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
js
personal.bnz.co.ew.cloudns.nz/kia-col/bank/Kiwibank/index_files/ |
382 KB 383 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
personal.bnz.co.ew.cloudns.nz/kia-col/bank/Kiwibank/index_files/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ScriptResource.js
personal.bnz.co.ew.cloudns.nz/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
WebResource.js
personal.bnz.co.ew.cloudns.nz/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon_ms_error.gif
personal.bnz.co.ew.cloudns.nz/kia-col/bank/Kiwibank/index_files/ |
1 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
image.js
www.images-home.com/ |
210 B 693 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fraudwatch-logo-266.png
personal.bnz.co.ew.cloudns.nz/kia-col/bank/Kiwibank/index_files/ |
10 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
xUHQI
personal.bnz.co.ew.cloudns.nz/C6dCeZ/rc9i/YHI1/OW-D/b60cBH/f7rucfSVuk7i/TXZPMGgAJwM/aGAxdn/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
print.css
personal.bnz.co.ew.cloudns.nz/kia-col/bank/Kiwibank/index_files/ |
1 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gtm.js
www.googletagmanager.com/ |
299 KB 81 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
media.css
personal.bnz.co.ew.cloudns.nz/kia-col/bank/Kiwibank/index_files/ |
1 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
86975.gif
www.images-home.com/ |
43 B 518 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg-block-header-light.png
personal.bnz.co.ew.cloudns.nz/kia-col/bank/Kiwibank/images/ |
313 B 621 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg-padlock-sprite.png
personal.bnz.co.ew.cloudns.nz/kia-col/bank/Kiwibank/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
button-bg-round.png
personal.bnz.co.ew.cloudns.nz/kia-col/bank/Kiwibank/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
geograph-medium.woff2
personal.bnz.co.ew.cloudns.nz/kia-col/bank/Kiwibank/fonts/kiwibank/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
geograph-regular.woff2
personal.bnz.co.ew.cloudns.nz/kia-col/bank/Kiwibank/fonts/kiwibank/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
272 KB 90 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
52 KB 21 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
analytics.google.com/g/ |
0 264 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
stats.g.doubleclick.net/g/ |
0 264 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ga-audiences
www.google.co.nz/ads/ |
42 B 408 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
www.google-analytics.com/j/ |
4 B 219 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
stats.g.doubleclick.net/j/ |
7 B 154 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ga-audiences
www.google.com/ads/ |
42 B 408 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ga-audiences
www.google.co.nz/ads/ |
42 B 107 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Kiwibank (Banking)50 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture function| toggleDetail function| toggleElement function| hideElement function| showElement function| showHideElementById function| number_format function| CheckAutoTab function| getAmountFromFormattedAmount function| stripCharsFromAmount function| clickOnce function| getHomeLoanService function| updatePaymentsTotal function| handleGetHomeLoanAmountResponse object| SourceMap object| kiwibank object| AutoTabKeyCodesToIgnore string| allowableChars function| CalculatorView function| $ function| jQuery function| _ object| Backbone string| output function| TimeSpan function| TimePeriod object| noUiSlider object| ES6Promise object| JSON3 function| StackFrame function| StackTraceGPS object| StackGenerator object| ErrorStackParser object| StackTrace object| kbf object| kbaccountnumber object| kbtaxaccountnumber object| kbkiwiwealthaccountnumber object| kbbilleraccountnumber object| dataLayer object| theForm function| __doPostBack object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga function| onYouTubeIframeAPIReady object| gaGlobal object| gaplugins object| gaData7 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
personal.bnz.co.ew.cloudns.nz/ | Name: PHPSESSID Value: a76ek1o2rtirliagu9rum6phei |
|
www.images-home.com/ | Name: AWSALBCORS Value: 2rdWBptsoziPluPelWeQ7Tq5QG/Dp10fMRIt00PbAac6W2fqHUj4HqWNkrHh6PxawoKmUTv0YnsDGUF3JvkDYfSDbR+P9rAJrZcGgmMhlWKKZNRG17r17TJDDGzO |
|
.cloudns.nz/ | Name: _ga Value: GA1.1.2142062453.1703033992 |
|
.cloudns.nz/ | Name: _ga_LSNKHQJZHL Value: GS1.1.1703033991.1.0.1703033991.60.0.0 |
|
.personal.bnz.co.ew.cloudns.nz/ | Name: _ga Value: GA1.6.2142062453.1703033992 |
|
.personal.bnz.co.ew.cloudns.nz/ | Name: _gid Value: GA1.6.728601284.1703033992 |
|
.personal.bnz.co.ew.cloudns.nz/ | Name: _gat_UA-45821112-1 Value: 1 |
6 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
analytics.google.com
personal.bnz.co.ew.cloudns.nz
stats.g.doubleclick.net
www.google-analytics.com
www.google.co.nz
www.google.com
www.googletagmanager.com
www.images-home.com
108.165.237.187
13.54.222.143
2404:6800:4003:c1a::9a
2404:6800:4006:809::2004
2404:6800:4006:809::200e
2404:6800:4006:80a::2008
2404:6800:4006:810::2003
2404:6800:4006:814::200e
11acca568c42cc3abec4cf4e12b3f5eab4dc7193ccdeec53561c159df088fb9f
120e2bfd4487aced2d8136d7dc7da0aaaa7deb2983c9d4fd6f44d274a642a2bb
26cddcc92ab70832e9f9452bacc3f36a110b24ef573967921da05d4eb7a82c4f
2e7c788059dbcb284ebd225c3bda912c9aed3fa92d8dc33bcc1a1e10bb8a4222
350a787a722a405da6e1c1c8de24d50a63726bef3d25e8fb020352e60ef35ee2
47f3a82c0fd4785efa18ca15b38c8db31c8a795debcf1da8e40d6e18a3a9f342
52e176f08b6974453767a3838d48802e20ce81036808e001e952cf514e2c958c
86d5e50eee00c010a3f8d9380fa0ef5ada9609f5c15ea639bd4071bfa0ce1e55
898aacff9ca5bbabb20cc8d95194ac050ee91b25fbc5897dd397aaea4a4755f8
980d323f8496fdf7a4c786c815cc1d29754faa08df717661fea659f35e5c378a
9d04ee2940506448a76d77d9ed9d8c2014f881c0cd4b1c60dd5dd9239e0c4d7b
a9773d824a52e948af972ac569eaeac46e74705395926bc2f54c5db7e1f47971
a9abd4099befa1bd1fbe1d91fc80824e6ad8310880b2ff31bb0e1de32354b7c6
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
cea57c4ba4d9ed618e0a3b97bd3275171b106a176e29f95634cbd3326cefe6ff
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b027a5fa3feb0cf20c75388b9e3fe3ffbb8893cb71871fc71198c3c1140c9d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ed1b73c6b4690cde9b521865b58e031293209bc0b2ba2b5716ecf4bf9885ee4b
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629