secure.anz.click Open in urlscan Pro
35.244.83.79  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request recover.html Show response secure.anz.click/recover/	6 KB 2 KB	961ms 324ms	Document text/html	35.244.83.79 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://secure.anz.click/recover/recover.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.244.83.79 Sydney, Australia, ASN15169 (GOOGLE, US), Reverse DNS 79.83.244.35.bc.googleusercontent.com Software nginx / PleskLin Resource Hash b0b5b95117bd5b2d3804492da377f370add7e18b2b96dd0e6cdac084468f8a1f Request headers :method GET :authority secure.anz.click :scheme https :path /recover/recover.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers server nginx date Thu, 01 Jul 2021 13:35:58 GMT content-type text/html last-modified Thu, 01 Jul 2021 00:25:20 GMT etag W/"60dd0b70-197d" x-powered-by PleskLin content-encoding br
GET H2	200	style.css secure.anz.click/recover/	136 KB 21 KB	626ms 626ms	Stylesheet text/css	35.244.83.79 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://secure.anz.click/recover/style.css Requested by Host: secure.anz.click URL: https://secure.anz.click/recover/recover.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.244.83.79 Sydney, Australia, ASN15169 (GOOGLE, US), Reverse DNS 79.83.244.35.bc.googleusercontent.com Software nginx / PleskLin Resource Hash 04ea9cb5a717696bfdb18c656ce4f2efeaff19d7bfb3d06a538f9276ba756f34 Request headers :path /recover/style.css pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority secure.anz.click referer https://secure.anz.click/recover/recover.html :scheme https sec-fetch-site same-origin :method GET Referer https://secure.anz.click/recover/recover.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 01 Jul 2021 13:35:58 GMT content-encoding br etag W/"607b8a00-22026" last-modified Sun, 18 Apr 2021 01:23:12 GMT server nginx x-powered-by PleskLin content-type text/css
GET H/1.1	200 OK	logo-anz.svg www.recovery.anz.com/recover/assets/	38 KB 38 KB	1743ms 374ms	Image image/svg+xml	202.2.56.161 ANZ-BANK-AP Austr...
General Check archive.org Show headers Download Go to Show image Full URL https://www.recovery.anz.com/recover/assets/logo-anz.svg Requested by Host: secure.anz.click URL: https://secure.anz.click/recover/recover.html Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_CBC Server 202.2.56.161 , Australia, ASN9564 (ANZ-BANK-AP Australia and New Zealand Banking Group Limited, AU), Reverse DNS Software / Resource Hash df477d03866885295a31b44c475bc6150273fc522c3bd5c1db69478650ebc2a5 Security Headers Name Value Content-Security-Policy default-src=self Strict-Transport-Security max-age=31536000;includeSubDomains X-Content-Type-Options default-src=self X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers Referer https://secure.anz.click/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 01 Jul 2021 13:36:00 GMT Strict-Transport-Security max-age=31536000;includeSubDomains X-Content-Type-Options default-src=self Last-Modified Fri, 11 Jun 2021 20:01:57 GMT ETag "1e65-97ce-5c482fade4dc2" X-Frame-Options DENY Content-Type image/svg+xml Cache-Control no-store;max-age=0 Content-Security-Policy default-src=self Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=10, max=100 Content-Length 38862 X-XSS-Protection 1; mode=block
GET H2	200	19d63e6239c69c0f44839bda2b14f3a3.woff secure.anz.click/recover/	51 KB 52 KB	642ms 640ms	Font font/woff	35.244.83.79 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://secure.anz.click/recover/19d63e6239c69c0f44839bda2b14f3a3.woff Requested by Host: secure.anz.click URL: https://secure.anz.click/recover/style.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.244.83.79 Sydney, Australia, ASN15169 (GOOGLE, US), Reverse DNS 79.83.244.35.bc.googleusercontent.com Software nginx / PleskLin Resource Hash 9af4df3b7f044525975716b175351fa75553070734627cf3b1325332284208c5 Request headers :path /recover/19d63e6239c69c0f44839bda2b14f3a3.woff pragma no-cache origin https://secure.anz.click accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode cors accept */* cache-control no-cache sec-fetch-dest font :authority secure.anz.click referer https://secure.anz.click/recover/style.css :scheme https sec-fetch-site same-origin :method GET Origin https://secure.anz.click Referer https://secure.anz.click/recover/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 01 Jul 2021 13:35:59 GMT last-modified Sun, 18 Apr 2021 01:23:12 GMT server nginx x-powered-by PleskLin etag "607b8a00-cdb0" content-type font/woff accept-ranges bytes content-length 52656
GET H2	200	b8d3788f91c669a1925bd89496e7f5c0.woff secure.anz.click/recover/	51 KB 51 KB	354ms 353ms	Font font/woff	35.244.83.79 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://secure.anz.click/recover/b8d3788f91c669a1925bd89496e7f5c0.woff Requested by Host: secure.anz.click URL: https://secure.anz.click/recover/style.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.244.83.79 Sydney, Australia, ASN15169 (GOOGLE, US), Reverse DNS 79.83.244.35.bc.googleusercontent.com Software nginx / PleskLin Resource Hash a3080630cedf7c6bb87229c4b11d206b3adb83753ced5558c7fea114bc0fd87a Request headers :path /recover/b8d3788f91c669a1925bd89496e7f5c0.woff pragma no-cache origin https://secure.anz.click accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode cors accept */* cache-control no-cache sec-fetch-dest font :authority secure.anz.click referer https://secure.anz.click/recover/style.css :scheme https sec-fetch-site same-origin :method GET Origin https://secure.anz.click Referer https://secure.anz.click/recover/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 01 Jul 2021 13:35:59 GMT last-modified Sun, 18 Apr 2021 01:23:12 GMT server nginx x-powered-by PleskLin etag "607b8a00-cbac" content-type font/woff accept-ranges bytes content-length 52140
GET H2	200	card-icon-large-screen.svg secure.anz.click/recover/assets/	3 KB 3 KB	339ms 338ms	Image image/svg+xml	35.244.83.79 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://secure.anz.click/recover/assets/card-icon-large-screen.svg Requested by Host: secure.anz.click URL: https://secure.anz.click/recover/style.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.244.83.79 Sydney, Australia, ASN15169 (GOOGLE, US), Reverse DNS 79.83.244.35.bc.googleusercontent.com Software nginx / PleskLin Resource Hash 8557637090eebf59a0454d5b99aae258ffe108a9cf7d11f329e5982d5658585f Request headers :path /recover/assets/card-icon-large-screen.svg pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority secure.anz.click referer https://secure.anz.click/recover/style.css :scheme https sec-fetch-site same-origin :method GET Referer https://secure.anz.click/recover/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 01 Jul 2021 13:35:59 GMT last-modified Sun, 18 Apr 2021 01:23:12 GMT server nginx x-powered-by PleskLin etag "607b8a00-b17" content-type image/svg+xml accept-ranges bytes content-length 2839
GET H2	200	phone-icon-large-screen.svg secure.anz.click/recover/assets/	3 KB 3 KB	335ms 335ms	Image image/svg+xml	35.244.83.79 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://secure.anz.click/recover/assets/phone-icon-large-screen.svg Requested by Host: secure.anz.click URL: https://secure.anz.click/recover/style.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.244.83.79 Sydney, Australia, ASN15169 (GOOGLE, US), Reverse DNS 79.83.244.35.bc.googleusercontent.com Software nginx / PleskLin Resource Hash ac26495e9592c85af76981f022d1ac53f2039042c894248525983ab7a472300b Request headers :path /recover/assets/phone-icon-large-screen.svg pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority secure.anz.click referer https://secure.anz.click/recover/style.css :scheme https sec-fetch-site same-origin :method GET Referer https://secure.anz.click/recover/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 01 Jul 2021 13:35:59 GMT last-modified Sun, 18 Apr 2021 01:23:12 GMT server nginx x-powered-by PleskLin etag "607b8a00-b30" content-type image/svg+xml accept-ranges bytes content-length 2864
GET H2	200	b1b91c2bf9ce25b5a07df78739428781.woff secure.anz.click/recover/	52 KB 52 KB	887ms 886ms	Font font/woff	35.244.83.79 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://secure.anz.click/recover/b1b91c2bf9ce25b5a07df78739428781.woff Requested by Host: secure.anz.click URL: https://secure.anz.click/recover/style.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.244.83.79 Sydney, Australia, ASN15169 (GOOGLE, US), Reverse DNS 79.83.244.35.bc.googleusercontent.com Software nginx / PleskLin Resource Hash b6bf163550dd994ccb01b937f1210281ec8681bfea58b38cf92b266a3d257cfc Request headers :path /recover/b1b91c2bf9ce25b5a07df78739428781.woff pragma no-cache origin https://secure.anz.click accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode cors accept */* cache-control no-cache sec-fetch-dest font :authority secure.anz.click referer https://secure.anz.click/recover/style.css :scheme https sec-fetch-site same-origin :method GET Origin https://secure.anz.click Referer https://secure.anz.click/recover/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 01 Jul 2021 13:35:59 GMT last-modified Sun, 18 Apr 2021 01:23:12 GMT server nginx x-powered-by PleskLin etag "607b8a00-ce48" content-type font/woff accept-ranges bytes content-length 52808

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ANZ Bank (Banking)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

secure.anz.click
www.recovery.anz.com
202.2.56.161
35.244.83.79
04ea9cb5a717696bfdb18c656ce4f2efeaff19d7bfb3d06a538f9276ba756f34
8557637090eebf59a0454d5b99aae258ffe108a9cf7d11f329e5982d5658585f
9af4df3b7f044525975716b175351fa75553070734627cf3b1325332284208c5
a3080630cedf7c6bb87229c4b11d206b3adb83753ced5558c7fea114bc0fd87a
ac26495e9592c85af76981f022d1ac53f2039042c894248525983ab7a472300b
b0b5b95117bd5b2d3804492da377f370add7e18b2b96dd0e6cdac084468f8a1f
b6bf163550dd994ccb01b937f1210281ec8681bfea58b38cf92b266a3d257cfc
df477d03866885295a31b44c475bc6150273fc522c3bd5c1db69478650ebc2a5