anz-help.com Open in urlscan Pro
27.54.81.161 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://anz-help.com/pages
Submission: On March 26 via manual (March 26th 2023, 10:19:44 pm UTC) from AU — Scanned from AU

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 11 HTTP transactions. The main IP is 27.54.81.161, located in Melbourne, Australia and belongs to DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU. The main domain is anz-help.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on November 1st 2022. Valid for: a year.

This is the only time anz-help.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: ANZ Bank (Banking)

Domain & IP information

	IP Address		AS Autonomous System
11	27.54.81.161 27.54.81.161		38719 (DREAMSCAP...) (DREAMSCAPE-AS-AP Dreamscape Networks Limited)
11	1

11 27.54.81.161 (Melbourne, Australia)

ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU)
PTR: ip1b3651a1.ipv4.syd02.ds.network

anz-help.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	anz-help.com anz-help.com	212 KB
11	1

	Domain	Requested by
11	anz-help.com	anz-help.com
11	1

This site contains no links.

Subject Issuer	Validity	Valid
eveready.com.au Sectigo RSA Domain Validation Secure Server CA	`2022-11-01` - `2023-11-01`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://anz-help.com/pages
Frame ID: 0C76D25D535829F968EA13C4F814B84A
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login - ANZ Internet Banking

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

11
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

212 kB
Transfer

316 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request pages Show response anz-help.com/	49 KB 12 KB	406ms 202ms	Document text/html	27.54.81.161 DREAMSCAPE-AS-AP ...
General Check archive.org Show headers Download Go to Full URL https://anz-help.com/pages Protocol H2 Security TLS 1.3, , AES_128_GCM Server 27.54.81.161 Melbourne, Australia, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU), Reverse DNS ip1b3651a1.ipv4.syd02.ds.network Software nginx / PHP/8.0.22 Resource Hash `cd9bc82d4acae9b17835592e6f0aa151f1fdf09981eae247878c1a72d1aa386f` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 accept-language en-AU,en;q=0.9 Response headers cache-control no-store, no-cache, must-revalidate content-encoding gzip content-length 12327 content-type text/html; charset=UTF-8 date Sun, 26 Mar 2023 22:19:39 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server nginx vary Accept-Encoding x-powered-by PHP/8.0.22
GET H2	200	jquery.js Show response anz-help.com/js/cntdjs/	87 KB 38 KB	119ms 117ms	Script application/javascript	27.54.81.161 DREAMSCAPE-AS-AP ...
General Check archive.org Show headers Download Go to Full URL https://anz-help.com/js/cntdjs/jquery.js Requested by Host: anz-help.com URL: https://anz-help.com/pages Protocol H2 Security TLS 1.3, , AES_128_GCM Server 27.54.81.161 Melbourne, Australia, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU), Reverse DNS ip1b3651a1.ipv4.syd02.ds.network Software nginx / Resource Hash `ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e` Request headers accept-language en-AU,en;q=0.9 Referer https://anz-help.com/pages User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers date Sun, 26 Mar 2023 22:19:40 GMT content-encoding gzip last-modified Sun, 29 May 2022 06:03:04 GMT server nginx accept-ranges bytes vary Accept-Encoding content-type application/javascript
GET H2	200	jquery.mask.js Show response anz-help.com/js/cntdjs/	23 KB 7 KB	117ms 116ms	Script application/javascript	27.54.81.161 DREAMSCAPE-AS-AP ...
General Check archive.org Show headers Download Go to Full URL https://anz-help.com/js/cntdjs/jquery.mask.js Requested by Host: anz-help.com URL: https://anz-help.com/pages Protocol H2 Security TLS 1.3, , AES_128_GCM Server 27.54.81.161 Melbourne, Australia, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU), Reverse DNS ip1b3651a1.ipv4.syd02.ds.network Software nginx / Resource Hash `a199620fe981df00a825f78761d3f7c8870f8117daa4a890e08018dec386dae8` Request headers accept-language en-AU,en;q=0.9 Referer https://anz-help.com/pages User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers date Sun, 26 Mar 2023 22:19:40 GMT content-encoding gzip last-modified Sun, 29 May 2022 06:03:04 GMT server nginx vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 6846
GET H2	200	cntd.js Show response anz-help.com/js/cntdjs/	3 KB 1 KB	116ms 115ms	Script application/javascript	27.54.81.161 DREAMSCAPE-AS-AP ...
General Check archive.org Show headers Download Go to Full URL https://anz-help.com/js/cntdjs/cntd.js Requested by Host: anz-help.com URL: https://anz-help.com/pages Protocol H2 Security TLS 1.3, , AES_128_GCM Server 27.54.81.161 Melbourne, Australia, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU), Reverse DNS ip1b3651a1.ipv4.syd02.ds.network Software nginx / Resource Hash `5b056148977cddad1d04190e8588f71549f5fbce2c8504fd0a52699a451896ca` Request headers accept-language en-AU,en;q=0.9 Referer https://anz-help.com/pages User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers date Sun, 26 Mar 2023 22:19:40 GMT content-encoding gzip last-modified Sun, 29 May 2022 06:03:04 GMT server nginx vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 1016
GET H2	200	loading.js Show response anz-help.com/js/shared/	2 KB 887 B	115ms 115ms	Script application/javascript	27.54.81.161 DREAMSCAPE-AS-AP ...
General Check archive.org Show headers Download Go to Full URL https://anz-help.com/js/shared/loading.js Requested by Host: anz-help.com URL: https://anz-help.com/pages Protocol H2 Security TLS 1.3, , AES_128_GCM Server 27.54.81.161 Melbourne, Australia, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU), Reverse DNS ip1b3651a1.ipv4.syd02.ds.network Software nginx / Resource Hash `4bdc871a71df801aa86926434d6fbed9744ec4757af4e9d6d40978724ea59134` Request headers accept-language en-AU,en;q=0.9 Referer https://anz-help.com/pages User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers date Sun, 26 Mar 2023 22:19:40 GMT content-encoding gzip last-modified Sun, 29 May 2022 06:03:04 GMT server nginx vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 740
GET H2	200	online_status.js Show response anz-help.com/js/shared/	998 B 599 B	114ms 113ms	Script application/javascript	27.54.81.161 DREAMSCAPE-AS-AP ...
General Check archive.org Show headers Download Go to Full URL https://anz-help.com/js/shared/online_status.js Requested by Host: anz-help.com URL: https://anz-help.com/pages Protocol H2 Security TLS 1.3, , AES_128_GCM Server 27.54.81.161 Melbourne, Australia, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU), Reverse DNS ip1b3651a1.ipv4.syd02.ds.network Software nginx / Resource Hash `e64e9d464beb9fe2717cd8bd8d093bb04d570f08a15c65f14533733904e12be7` Request headers accept-language en-AU,en;q=0.9 Referer https://anz-help.com/pages User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers date Sun, 26 Mar 2023 22:19:40 GMT content-encoding gzip last-modified Sun, 29 May 2022 06:03:04 GMT server nginx vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 452
GET H2	200	anz-logo.1.0.0.svg anz-help.com/front_end/front_end_files/	38 KB 38 KB	202ms 201ms	Image image/svg+xml	27.54.81.161 DREAMSCAPE-AS-AP ...
General Check archive.org Show headers Download Go to Show image Full URL https://anz-help.com/front_end/front_end_files/anz-logo.1.0.0.svg Requested by Host: anz-help.com URL: https://anz-help.com/pages Protocol H2 Security TLS 1.3, , AES_128_GCM Server 27.54.81.161 Melbourne, Australia, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU), Reverse DNS ip1b3651a1.ipv4.syd02.ds.network Software nginx / Resource Hash `df477d03866885295a31b44c475bc6150273fc522c3bd5c1db69478650ebc2a5` Request headers accept-language en-AU,en;q=0.9 Referer https://anz-help.com/pages User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers date Sun, 26 Mar 2023 22:19:40 GMT last-modified Sun, 29 May 2022 06:09:02 GMT server nginx accept-ranges bytes content-length 38862 content-type image/svg+xml
GET H2	200	ib-login-support.1.0.0.svg anz-help.com/front_end/front_end_files/	11 KB 11 KB	201ms 200ms	Image image/svg+xml	27.54.81.161 DREAMSCAPE-AS-AP ...
General Check archive.org Show headers Download Go to Show image Full URL https://anz-help.com/front_end/front_end_files/ib-login-support.1.0.0.svg Requested by Host: anz-help.com URL: https://anz-help.com/pages Protocol H2 Security TLS 1.3, , AES_128_GCM Server 27.54.81.161 Melbourne, Australia, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU), Reverse DNS ip1b3651a1.ipv4.syd02.ds.network Software nginx / Resource Hash `0f2f421d03f0dd094f5eeea11c1b78898bb8c38cdc6a9859627617bbb4db363e` Request headers accept-language en-AU,en;q=0.9 Referer https://anz-help.com/pages User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers date Sun, 26 Mar 2023 22:19:40 GMT last-modified Sun, 29 May 2022 06:09:02 GMT server nginx accept-ranges bytes content-length 11037 content-type image/svg+xml
GET H2	404	anz-logo.1.0.0.svg anz-help.com/assets/img/	0 191 B	297ms 296ms	Image text/html	27.54.81.161 DREAMSCAPE-AS-AP ...
General Check archive.org Show headers Download Go to Show image Full URL https://anz-help.com/assets/img/anz-logo.1.0.0.svg Requested by Host: anz-help.com URL: https://anz-help.com/pages Protocol H2 Security TLS 1.3, , AES_128_GCM Server 27.54.81.161 Melbourne, Australia, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU), Reverse DNS ip1b3651a1.ipv4.syd02.ds.network Software nginx / PHP/8.0.22 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language en-AU,en;q=0.9 Referer https://anz-help.com/pages User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers pragma no-cache date Sun, 26 Mar 2023 22:19:40 GMT server nginx x-powered-by PHP/8.0.22 content-type text/html; charset=UTF-8 cache-control no-store, no-cache, must-revalidate content-length 0 expires Thu, 19 Nov 1981 08:52:00 GMT
GET H2	200	MyriadPro-Regular.1.0.0.woff anz-help.com/front_end/front_end_files/	51 KB 52 KB	118ms 117ms	Font font/woff	27.54.81.161 DREAMSCAPE-AS-AP ...
General Check archive.org Show headers Download Go to Full URL https://anz-help.com/front_end/front_end_files/MyriadPro-Regular.1.0.0.woff Requested by Host: anz-help.com URL: https://anz-help.com/pages Protocol H2 Security TLS 1.3, , AES_128_GCM Server 27.54.81.161 Melbourne, Australia, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU), Reverse DNS ip1b3651a1.ipv4.syd02.ds.network Software nginx / Resource Hash `9af4df3b7f044525975716b175351fa75553070734627cf3b1325332284208c5` Request headers Referer https://anz-help.com/pages Origin https://anz-help.com accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers date Sun, 26 Mar 2023 22:19:40 GMT last-modified Sun, 29 May 2022 06:09:02 GMT server nginx accept-ranges bytes content-length 52656 content-type font/woff
GET H2	200	MyriadPro-Semibold.1.0.0.woff anz-help.com/front_end/front_end_files/	52 KB 52 KB	115ms 115ms	Font font/woff	27.54.81.161 DREAMSCAPE-AS-AP ...
General Check archive.org Show headers Download Go to Full URL https://anz-help.com/front_end/front_end_files/MyriadPro-Semibold.1.0.0.woff Requested by Host: anz-help.com URL: https://anz-help.com/pages Protocol H2 Security TLS 1.3, , AES_128_GCM Server 27.54.81.161 Melbourne, Australia, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU), Reverse DNS ip1b3651a1.ipv4.syd02.ds.network Software nginx / Resource Hash `b6bf163550dd994ccb01b937f1210281ec8681bfea58b38cf92b266a3d257cfc` Request headers Referer https://anz-help.com/pages Origin https://anz-help.com accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers date Sun, 26 Mar 2023 22:19:40 GMT last-modified Sun, 29 May 2022 06:09:02 GMT server nginx accept-ranges bytes content-length 52808 content-type font/woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ANZ Bank (Banking)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			anz-help.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: mlkisddoskpa23015721s6tc5p

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://anz-help.com/assets/img/anz-logo.1.0.0.svg Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

anz-help.com
27.54.81.161
0f2f421d03f0dd094f5eeea11c1b78898bb8c38cdc6a9859627617bbb4db363e
4bdc871a71df801aa86926434d6fbed9744ec4757af4e9d6d40978724ea59134
5b056148977cddad1d04190e8588f71549f5fbce2c8504fd0a52699a451896ca
9af4df3b7f044525975716b175351fa75553070734627cf3b1325332284208c5
a199620fe981df00a825f78761d3f7c8870f8117daa4a890e08018dec386dae8
b6bf163550dd994ccb01b937f1210281ec8681bfea58b38cf92b266a3d257cfc
cd9bc82d4acae9b17835592e6f0aa151f1fdf09981eae247878c1a72d1aa386f
df477d03866885295a31b44c475bc6150273fc522c3bd5c1db69478650ebc2a5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e64e9d464beb9fe2717cd8bd8d093bb04d570f08a15c65f14533733904e12be7
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

anz-help.com Open in urlscan Pro 27.54.81.161 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

11 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

212 kBTransfer

316 kBSize

1 Cookies

0 Outgoing links

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

anz-help.com Open in urlscan Pro
27.54.81.161 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

212 kB
Transfer

316 kB
Size

1
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!