bnz.co-nz-agb-session-brj2n4.xyz
Open in
urlscan Pro
47.88.28.95
Malicious Activity!
Public Scan
Effective URL: https://bnz.co-nz-agb-session-brj2n4.xyz/login.php
Submission: On December 13 via manual from NZ — Scanned from NZ
Summary
TLS certificate: Issued by R3 on December 13th 2022. Valid for: 3 months.
This is the only time bnz.co-nz-agb-session-brj2n4.xyz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: BNZ Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 2 | 161.35.255.96 161.35.255.96 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
2 | 155.207.1.6 155.207.1.6 | 5470 (ASAUTHNET...) (ASAUTHNET AUTH-NET-AS) | |
8 | 47.88.28.95 47.88.28.95 | 45102 (ALIBABA-C...) (ALIBABA-CN-NET Alibaba US Technology Co.) | |
1 | 23.215.7.13 23.215.7.13 | () () | |
13 | 4 |
ASN5470 (ASAUTHNET AUTH-NET-AS, GR)
PTR: elpida3.it.auth.gr
kpanagiota.webpages.auth.gr |
ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN)
bnz.co-nz-agb-session-brj2n4.xyz |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
co-nz-agb-session-brj2n4.xyz
bnz.co-nz-agb-session-brj2n4.xyz |
61 KB |
2 |
auth.gr
kpanagiota.webpages.auth.gr |
3 KB |
2 |
bnz-live.info
2 redirects
bnz-live.info |
1 KB |
1 |
bnz.co.nz
www.bnz.co.nz |
812 B |
13 | 4 |
Domain | Requested by | |
---|---|---|
8 | bnz.co-nz-agb-session-brj2n4.xyz |
bnz.co-nz-agb-session-brj2n4.xyz
|
2 | kpanagiota.webpages.auth.gr |
kpanagiota.webpages.auth.gr
|
2 | bnz-live.info | 2 redirects |
1 | www.bnz.co.nz |
bnz.co-nz-agb-session-brj2n4.xyz
www.bnz.co.nz |
13 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
bnz.co-nz-agb-session-brj2n4.xyz R3 |
2022-12-13 - 2023-03-13 |
3 months | crt.sh |
bnz.co.nz Entrust Certification Authority - L1K |
2022-09-20 - 2023-10-20 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://bnz.co-nz-agb-session-brj2n4.xyz/login.php
Frame ID: 513CB47AE5A1418FF02F6E45CB2E7A8B
Requests: 13 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://bnz-live.info/
HTTP 308
https://bnz-live.info/ HTTP 302
http://kpanagiota.webpages.auth.gr/dishwashing.php/ Page URL
- http://kpanagiota.webpages.auth.gr/dishwashing.php/ Page URL
- https://bnz.co-nz-agb-session-brj2n4.xyz/ Page URL
- https://bnz.co-nz-agb-session-brj2n4.xyz/login.php Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Bootstrap (Web Frameworks) Expand
Detected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://bnz-live.info/
HTTP 308
https://bnz-live.info/ HTTP 302
http://kpanagiota.webpages.auth.gr/dishwashing.php/ Page URL
- http://kpanagiota.webpages.auth.gr/dishwashing.php/ Page URL
- https://bnz.co-nz-agb-session-brj2n4.xyz/ Page URL
- https://bnz.co-nz-agb-session-brj2n4.xyz/login.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://bnz-live.info/ HTTP 308
- https://bnz-live.info/ HTTP 302
- http://kpanagiota.webpages.auth.gr/dishwashing.php/
13 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
kpanagiota.webpages.auth.gr/dishwashing.php/ Redirect Chain
|
1 KB 878 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
kpanagiota.webpages.auth.gr/dishwashing.php/ |
15 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
bnz.co-nz-agb-session-brj2n4.xyz/ |
147 B 533 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
login.php
bnz.co-nz-agb-session-brj2n4.xyz/ |
60 KB 10 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
serrano.css
www.bnz.co.nz/serrano/ |
2 KB 812 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jq.js
bnz.co-nz-agb-session-brj2n4.xyz/assets/page/ |
87 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
popper.min.js
bnz.co-nz-agb-session-brj2n4.xyz/assets/page/ |
19 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.min.js
bnz.co-nz-agb-session-brj2n4.xyz/assets/page/ |
48 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
3.26169592.chunk.js
bnz.co-nz-agb-session-brj2n4.xyz/auth/static/js/ |
0 0 |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
4.20f0dca4.chunk.js
bnz.co-nz-agb-session-brj2n4.xyz/auth/static/js/ |
0 0 |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
5.7526313e.chunk.js
bnz.co-nz-agb-session-brj2n4.xyz/auth/static/js/ |
0 0 |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
SerranoWeb-Bold.woff2
www.bnz.co.nz/serrano/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
SerranoWeb-Regular.woff2
www.bnz.co.nz/serrano/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- www.bnz.co.nz
- URL
- https://www.bnz.co.nz/serrano/fonts/SerranoWeb-Bold.woff2?v=1c25c2c065
- Domain
- www.bnz.co.nz
- URL
- https://www.bnz.co.nz/serrano/fonts/SerranoWeb-Regular.woff2?v=5b6826770c
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: BNZ Bank (Banking)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontentvisibilityautostatechange9 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
bnz-live.info/ | Name: XSRF-TOKEN Value: eyJpdiI6IjhzcEJ6bmVjbWNSMnJ3M2FqeTZUMnc9PSIsInZhbHVlIjoiQTB2U1JYbDNRVUhqdERBQ3MzREJBMk1WVzlzemtOeXhzeGROaTlkdG9FSGg4YmczVVNtRGlXL0gzNHdJMXFYOUNJOEpqNUVOSzhCdDFYZ0ZLVCtvYjYrMDdaU2Z6WS9CdkJHZzV3eUpQTTFGdnR6OE5sVkgySWdPZ2lNRjZGbngiLCJtYWMiOiI1MWYwZmFjYjgwNGQ5NmE5YzQ1ZWZhYWUyNmEzZWUyYTNmODM0YTY3ZTEyNGYyODExZGI0YWI5ZjNkZmViMWM4IiwidGFnIjoiIn0%3D |
|
bnz-live.info/ | Name: tly_session Value: eyJpdiI6IkRNMms3U0NDMElmYVdOc29yUk53ZHc9PSIsInZhbHVlIjoicmtRNnpaZGc4V2FtYmkyWnNwK2dGNjlmY1FGK1ZpTDNBclVpN1A1T0w3ZWhJMU9ZcDl2WDQ4TGpRNkY0aXBwVjZ0UzJuNmJ4dCtSS3FxVDdabGo5TlA4dmV0UU5VOFJvL2JGNmlrM0EvMmV6cEg4NnZ4WExTVzNFVmwrRStKeVgiLCJtYWMiOiIxNjQ4OTg4MDgwYzI2NDdiNzYzMGI5ZTA0NmNiMjhiNDM3MjM0MDM3MDg0YWZkYzljNGI2N2MxNzlmNTQ4MzM0IiwidGFnIjoiIn0%3D |
|
kpanagiota.webpages.auth.gr/ | Name: d Value: 0 |
|
kpanagiota.webpages.auth.gr/ | Name: n Value: Etc/Unknown |
|
kpanagiota.webpages.auth.gr/ | Name: sp Value: Win32 |
|
kpanagiota.webpages.auth.gr/ | Name: su Value: Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/108.0.5359.98%20Safari/537.36 |
|
kpanagiota.webpages.auth.gr/ | Name: iu Value: Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/108.0.5359.98%20Safari/537.36 |
|
kpanagiota.webpages.auth.gr/ | Name: wd Value: false |
|
bnz.co-nz-agb-session-brj2n4.xyz/ | Name: PHPSESSID Value: ima39sgi7b30c3jmpu01bmekp4 |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bnz-live.info
bnz.co-nz-agb-session-brj2n4.xyz
kpanagiota.webpages.auth.gr
www.bnz.co.nz
www.bnz.co.nz
155.207.1.6
161.35.255.96
23.215.7.13
47.88.28.95
72d05cd7cdc6c75d0c828667f27a3d6f9f07ed0a1e7fcbbcaebeaedb3d3c8f20
9a2723c21fb1b7dff0e2aa5dc6be24a9670220a17ae21f70fdbc602d1f8acd38
b00834c17c50af103e353ef86a69d90bbcaa819ed92b4d6ed670a425514e3c3a
c7008cdde7b86827a2ad69aa1a6e40fa968dd3247e5a7983b56999ccc64e794a
d1550d30e03f777fb25a2761e42fd8640fc2891fe3f8319524e5a0f17ede803d
f8260d7d44cfb1f8029f9a65067d76476106c2dbf95aab7673a51198ca6b9659