ratusanpaksi.com.my Open in urlscan Pro
103.6.196.225  Malicious Activity! Public Scan

URL: https://ratusanpaksi.com.my/A/Asb/index.htm
Submission: On January 03 via automatic, source phishtank — Scanned from DE

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 18 HTTP transactions. The main IP is 103.6.196.225, located in Malaysia and belongs to EXABYTES-AS-AP Exa Bytes Network Sdn.Bhd., MY. The main domain is ratusanpaksi.com.my.
TLS certificate: Issued by cPanel, Inc. Certification Authority on November 23rd 2021. Valid for: 3 months.
This is the only time ratusanpaksi.com.my was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: ASB Bank (Banking)

Domain & IP information

IP Address AS Autonomous System
1 103.6.196.225 46015 (EXABYTES-...)
15 2.16.186.187 20940 (AKAMAI-ASN1)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
18 4
Domain Requested by
15 online.asb.co.nz ratusanpaksi.com.my
online.asb.co.nz
1 www.gstatic.com www.google.com
1 www.google.com ratusanpaksi.com.my
1 ratusanpaksi.com.my
18 4

This site contains links to these domains. Also see Links.

Domain
www.asb.co.nz
Subject Issuer Validity Valid
ratusanpaksi.com.my
cPanel, Inc. Certification Authority
2021-11-23 -
2022-02-21
3 months crt.sh
online.asb.co.nz
Entrust Certification Authority - L1M
2021-07-27 -
2022-07-27
a year crt.sh
www.google.com
GTS CA 1C3
2021-11-29 -
2022-02-21
3 months crt.sh
*.gstatic.com
GTS CA 1C3
2021-11-29 -
2022-02-21
3 months crt.sh

This page contains 1 frames:

Primary Page: https://ratusanpaksi.com.my/A/Asb/index.htm
Frame ID: 7E8CD0D260F1D25070653E75E4D3EC49
Requests: 18 HTTP requests in this frame

Screenshot

Page Title

ASB Bank - Log in

Detected technologies

Overall confidence: 100%
Detected patterns
  • ([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js

Overall confidence: 100%
Detected patterns
  • underscore.*\.js(?:\?ver=([\d.]+))?

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Overall confidence: 100%
Detected patterns
  • /recaptcha/api\.js

Page Statistics

18
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

234 kB
Transfer

546 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request index.htm
ratusanpaksi.com.my/A/Asb/
15 KB
15 KB
Document
General
Full URL
https://ratusanpaksi.com.my/A/Asb/index.htm
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.6.196.225 , Malaysia, ASN46015 (EXABYTES-AS-AP Exa Bytes Network Sdn.Bhd., MY),
Reverse DNS
power5.mschosting.com
Software
Apache /
Resource Hash
9d2cf50288ffa067e37fc5a7e10dc706e3772589bfc59b973061373bc3b5cb71

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

last-modified
Wed, 06 Nov 2019 23:23:50 GMT
accept-ranges
bytes
content-length
15456
content-type
text/html
date
Mon, 03 Jan 2022 17:10:24 GMT
server
Apache
screen.min.css
online.asb.co.nz/auth/css/
33 KB
8 KB
Stylesheet
General
Full URL
https://online.asb.co.nz/auth/css/screen.min.css?v=1.0.5.5
Requested by
Host: ratusanpaksi.com.my
URL: https://ratusanpaksi.com.my/A/Asb/index.htm
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.187 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e74bd29dc2fc1ad5f888f445713b120458fd28eda0f1da6c9a8ef7e5208317dc
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' www.google-analytics.com stats.g.doubleclick.net *.google.com *.gstatic.com *.asbbank.co.nz *.asb.co.nz asbbankltd.tt.omtrdc.net dpm.demdex.net asb.demdex.net cm.everesttech.net;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ratusanpaksi.com.my/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' www.google-analytics.com stats.g.doubleclick.net *.google.com *.gstatic.com *.asbbank.co.nz *.asb.co.nz asbbankltd.tt.omtrdc.net dpm.demdex.net asb.demdex.net cm.everesttech.net;
content-encoding
gzip
x-content-type-options
nosniff
p3p
CP="NON CUR OTPi OUR NOR UNI"
vary
Accept-Encoding
content-length
7365
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Tue, 03 Nov 2020 22:46:16 GMT
x-frame-options
SAMEORIGIN
date
Mon, 03 Jan 2022 17:10:26 GMT
strict-transport-security
max-age=31536000; includeSubDomains
content-type
text/css
cache-control
private, max-age=170232
etag
W/"33783-1604443576000"
accept-ranges
bytes
expires
Wed, 05 Jan 2022 16:27:38 GMT
modernizr-2.7.1.js
online.asb.co.nz/auth/js/
17 KB
8 KB
Script
General
Full URL
https://online.asb.co.nz/auth/js/modernizr-2.7.1.js?v=1.0.5.5
Requested by
Host: ratusanpaksi.com.my
URL: https://ratusanpaksi.com.my/A/Asb/index.htm
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.187 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
1274f09ff41e34718771c90edda5b41b011e4122006fbfb9bb6efa7adb392cce
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' www.google-analytics.com stats.g.doubleclick.net *.google.com *.gstatic.com *.asbbank.co.nz *.asb.co.nz asbbankltd.tt.omtrdc.net dpm.demdex.net asb.demdex.net cm.everesttech.net;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ratusanpaksi.com.my/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' www.google-analytics.com stats.g.doubleclick.net *.google.com *.gstatic.com *.asbbank.co.nz *.asb.co.nz asbbankltd.tt.omtrdc.net dpm.demdex.net asb.demdex.net cm.everesttech.net;
content-encoding
gzip
x-content-type-options
nosniff
p3p
CP="NON CUR OTPi OUR NOR UNI"
vary
Accept-Encoding
content-length
7482
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Tue, 03 Nov 2020 22:46:18 GMT
x-frame-options
SAMEORIGIN
date
Mon, 03 Jan 2022 17:10:26 GMT
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript
cache-control
private, max-age=170290
etag
W/"17146-1604443578000"
accept-ranges
bytes
expires
Wed, 05 Jan 2022 16:28:36 GMT
json2.min.js
online.asb.co.nz/auth/js/
3 KB
2 KB
Script
General
Full URL
https://online.asb.co.nz/auth/js/json2.min.js?v=1.0.5.5
Requested by
Host: ratusanpaksi.com.my
URL: https://ratusanpaksi.com.my/A/Asb/index.htm
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.187 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
ae53b8317e54a9e60cded2b876fa42538391c5d782b908995d5d54940f534ce5
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' www.google-analytics.com stats.g.doubleclick.net *.google.com *.gstatic.com *.asbbank.co.nz *.asb.co.nz asbbankltd.tt.omtrdc.net dpm.demdex.net asb.demdex.net cm.everesttech.net;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ratusanpaksi.com.my/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' www.google-analytics.com stats.g.doubleclick.net *.google.com *.gstatic.com *.asbbank.co.nz *.asb.co.nz asbbankltd.tt.omtrdc.net dpm.demdex.net asb.demdex.net cm.everesttech.net;
content-encoding
gzip
x-content-type-options
nosniff
p3p
CP="NON CUR OTPi OUR NOR UNI"
vary
Accept-Encoding
content-length
1460
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Tue, 03 Nov 2020 22:46:18 GMT
x-frame-options
SAMEORIGIN
date
Mon, 03 Jan 2022 17:10:26 GMT
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript
cache-control
private, max-age=170331
etag
W/"3479-1604443578000"
accept-ranges
bytes
expires
Wed, 05 Jan 2022 16:29:17 GMT
sha1.min.js
online.asb.co.nz/auth/js/
5 KB
2 KB
Script
General
Full URL
https://online.asb.co.nz/auth/js/sha1.min.js?v=1.0.5.5
Requested by
Host: ratusanpaksi.com.my
URL: https://ratusanpaksi.com.my/A/Asb/index.htm
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.187 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
10b33fdad14719c081f524e492199133dab898e40a5da5a393df1a3b9a3d0633
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' www.google-analytics.com stats.g.doubleclick.net *.google.com *.gstatic.com *.asbbank.co.nz *.asb.co.nz asbbankltd.tt.omtrdc.net dpm.demdex.net asb.demdex.net cm.everesttech.net;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ratusanpaksi.com.my/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' www.google-analytics.com stats.g.doubleclick.net *.google.com *.gstatic.com *.asbbank.co.nz *.asb.co.nz asbbankltd.tt.omtrdc.net dpm.demdex.net asb.demdex.net cm.everesttech.net;
content-encoding
gzip
x-content-type-options
nosniff
p3p
CP="NON CUR OTPi OUR NOR UNI"
vary
Accept-Encoding
content-length
1768
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Tue, 03 Nov 2020 22:46:18 GMT
x-frame-options
SAMEORIGIN
date
Mon, 03 Jan 2022 17:10:26 GMT
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript
cache-control
private, max-age=170098
etag
W/"4672-1604443578000"
accept-ranges
bytes
expires
Wed, 05 Jan 2022 16:25:24 GMT
jquery-1.11.0.min.js
online.asb.co.nz/auth/js/
94 KB
39 KB
Script
General
Full URL
https://online.asb.co.nz/auth/js/jquery-1.11.0.min.js?v=1.0.5.5
Requested by
Host: ratusanpaksi.com.my
URL: https://ratusanpaksi.com.my/A/Asb/index.htm
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.187 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
746e54e89161118a67bd59103c4ab55e3060735cc85c1d047c2cf04d4b12043d
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' www.google-analytics.com stats.g.doubleclick.net *.google.com *.gstatic.com *.asbbank.co.nz *.asb.co.nz asbbankltd.tt.omtrdc.net dpm.demdex.net asb.demdex.net cm.everesttech.net;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ratusanpaksi.com.my/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' www.google-analytics.com stats.g.doubleclick.net *.google.com *.gstatic.com *.asbbank.co.nz *.asb.co.nz asbbankltd.tt.omtrdc.net dpm.demdex.net asb.demdex.net cm.everesttech.net;
content-encoding
gzip
x-content-type-options
nosniff
p3p
CP="NON CUR OTPi OUR NOR UNI"
vary
Accept-Encoding
content-length
39029
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Tue, 03 Nov 2020 22:46:18 GMT
x-frame-options
SAMEORIGIN
date
Mon, 03 Jan 2022 17:10:26 GMT
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript
cache-control
private, max-age=170093
etag
W/"96385-1604443578000"
accept-ranges
bytes
expires
Wed, 05 Jan 2022 16:25:19 GMT
PopupManager.min.js
online.asb.co.nz/auth/js/
4 KB
2 KB
Script
General
Full URL
https://online.asb.co.nz/auth/js/PopupManager.min.js?v=1.0.5.5
Requested by
Host: ratusanpaksi.com.my
URL: https://ratusanpaksi.com.my/A/Asb/index.htm
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.187 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
bce31cd5fcf9edb3c13f68c8270e8dd6181b0dcb12143342a0e55bcf805fc92d
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' www.google-analytics.com stats.g.doubleclick.net *.google.com *.gstatic.com *.asbbank.co.nz *.asb.co.nz asbbankltd.tt.omtrdc.net dpm.demdex.net asb.demdex.net cm.everesttech.net;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ratusanpaksi.com.my/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' www.google-analytics.com stats.g.doubleclick.net *.google.com *.gstatic.com *.asbbank.co.nz *.asb.co.nz asbbankltd.tt.omtrdc.net dpm.demdex.net asb.demdex.net cm.everesttech.net;
content-encoding
gzip
x-content-type-options
nosniff
p3p
CP="NON CUR OTPi OUR NOR UNI"
vary
Accept-Encoding
content-length
1488
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Tue, 03 Nov 2020 22:46:18 GMT
x-frame-options
SAMEORIGIN
date
Mon, 03 Jan 2022 17:10:26 GMT
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript
cache-control
private, max-age=170084
etag
W/"4315-1604443578000"
accept-ranges
bytes
expires
Wed, 05 Jan 2022 16:25:10 GMT
custFontSize.min.js
online.asb.co.nz/auth/js/
852 B
985 B
Script
General
Full URL
https://online.asb.co.nz/auth/js/custFontSize.min.js?v=1.0.5.5
Requested by
Host: ratusanpaksi.com.my
URL: https://ratusanpaksi.com.my/A/Asb/index.htm
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.187 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
7e9524154c00820e477b9289c2a86727673c17edb1bf531b41771cc5d6245d5a
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' www.google-analytics.com stats.g.doubleclick.net *.google.com *.gstatic.com *.asbbank.co.nz *.asb.co.nz asbbankltd.tt.omtrdc.net dpm.demdex.net asb.demdex.net cm.everesttech.net;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ratusanpaksi.com.my/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' www.google-analytics.com stats.g.doubleclick.net *.google.com *.gstatic.com *.asbbank.co.nz *.asb.co.nz asbbankltd.tt.omtrdc.net dpm.demdex.net asb.demdex.net cm.everesttech.net;
content-encoding
gzip
x-content-type-options
nosniff
p3p
CP="NON CUR OTPi OUR NOR UNI"
vary
Accept-Encoding
content-length
433
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Tue, 03 Nov 2020 22:46:18 GMT
x-frame-options
SAMEORIGIN
date
Mon, 03 Jan 2022 17:10:26 GMT
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript
cache-control
private, max-age=170046
etag
W/"852-1604443578000"
accept-ranges
bytes
expires
Wed, 05 Jan 2022 16:24:32 GMT
underscore-min.js
online.asb.co.nz/auth/js/
16 KB
7 KB
Script
General
Full URL
https://online.asb.co.nz/auth/js/underscore-min.js?v=1.0.5.5
Requested by
Host: ratusanpaksi.com.my
URL: https://ratusanpaksi.com.my/A/Asb/index.htm
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.187 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
951349bd5206d7885ec9d7e299f2115618eeefdd9f9c53fdb834187aee291f03
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' www.google-analytics.com stats.g.doubleclick.net *.google.com *.gstatic.com *.asbbank.co.nz *.asb.co.nz asbbankltd.tt.omtrdc.net dpm.demdex.net asb.demdex.net cm.everesttech.net;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ratusanpaksi.com.my/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' www.google-analytics.com stats.g.doubleclick.net *.google.com *.gstatic.com *.asbbank.co.nz *.asb.co.nz asbbankltd.tt.omtrdc.net dpm.demdex.net asb.demdex.net cm.everesttech.net;
content-encoding
gzip
x-content-type-options
nosniff
p3p
CP="NON CUR OTPi OUR NOR UNI"
vary
Accept-Encoding
content-length
6552
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Tue, 03 Nov 2020 22:46:18 GMT
x-frame-options
SAMEORIGIN
date
Mon, 03 Jan 2022 17:10:26 GMT
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript
cache-control
private, max-age=170104
etag
W/"16415-1604443578000"
accept-ranges
bytes
expires
Wed, 05 Jan 2022 16:25:30 GMT
api.js
www.google.com/recaptcha/
909 B
993 B
Script
General
Full URL
https://www.google.com/recaptcha/api.js?onload=onloadCallback&render=explicit&hl=en
Requested by
Host: ratusanpaksi.com.my
URL: https://ratusanpaksi.com.my/A/Asb/index.htm
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
56ec90fb8916da4dab289939e0571d9586a63812b18b64890b09193cb7702d57
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ratusanpaksi.com.my/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Mon, 03 Jan 2022 17:10:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=300
cross-origin-resource-policy
cross-origin
content-security-policy
frame-ancestors 'self'
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
580
x-xss-protection
1; mode=block
expires
Mon, 03 Jan 2022 17:10:26 GMT
logo-asb.png
online.asb.co.nz/auth/img/
6 KB
6 KB
Image
General
Full URL
https://online.asb.co.nz/auth/img/logo-asb.png
Requested by
Host: ratusanpaksi.com.my
URL: https://ratusanpaksi.com.my/A/Asb/index.htm
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.187 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e315f2355d6b4b81b7d76ceead1530b04c38d85d3684f3a8cc9db79688464ea2
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' www.google-analytics.com stats.g.doubleclick.net *.google.com *.gstatic.com *.asbbank.co.nz *.asb.co.nz asbbankltd.tt.omtrdc.net dpm.demdex.net asb.demdex.net cm.everesttech.net;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ratusanpaksi.com.my/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' www.google-analytics.com stats.g.doubleclick.net *.google.com *.gstatic.com *.asbbank.co.nz *.asb.co.nz asbbankltd.tt.omtrdc.net dpm.demdex.net asb.demdex.net cm.everesttech.net;
referrer-policy
strict-origin-when-cross-origin
last-modified
Tue, 03 Nov 2020 22:46:18 GMT
etag
W/"6046-1604443578000"
x-frame-options
SAMEORIGIN
p3p
CP="NON CUR OTPi OUR NOR UNI"
x-xss-protection
1; mode=block
cache-control
private, max-age=170035
date
Mon, 03 Jan 2022 17:10:26 GMT
strict-transport-security
max-age=31536000; includeSubDomains
accept-ranges
bytes
content-type
image/png
content-length
6046
x-content-type-options
nosniff
expires
Wed, 05 Jan 2022 16:24:21 GMT
loginBody.min.js
online.asb.co.nz/auth/js/
2 KB
1 KB
Script
General
Full URL
https://online.asb.co.nz/auth/js/loginBody.min.js?v=1.0.5.5
Requested by
Host: ratusanpaksi.com.my
URL: https://ratusanpaksi.com.my/A/Asb/index.htm
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.187 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
3697c2d6dce22c53f2929a3a06a7b8d9c45fb3b3004d66a40e3ae5d523c769e0
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' www.google-analytics.com stats.g.doubleclick.net *.google.com *.gstatic.com *.asbbank.co.nz *.asb.co.nz asbbankltd.tt.omtrdc.net dpm.demdex.net asb.demdex.net cm.everesttech.net;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ratusanpaksi.com.my/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' www.google-analytics.com stats.g.doubleclick.net *.google.com *.gstatic.com *.asbbank.co.nz *.asb.co.nz asbbankltd.tt.omtrdc.net dpm.demdex.net asb.demdex.net cm.everesttech.net;
content-encoding
gzip
x-content-type-options
nosniff
p3p
CP="NON CUR OTPi OUR NOR UNI"
vary
Accept-Encoding
content-length
917
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Tue, 03 Nov 2020 22:46:18 GMT
x-frame-options
SAMEORIGIN
date
Mon, 03 Jan 2022 17:10:26 GMT
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript
cache-control
private, max-age=130145
etag
W/"2023-1604443578000"
accept-ranges
bytes
expires
Wed, 05 Jan 2022 05:19:31 GMT
p.min.js
online.asb.co.nz/auth/js/
2 KB
1 KB
Script
General
Full URL
https://online.asb.co.nz/auth/js/p.min.js?v=1.0.5.5
Requested by
Host: ratusanpaksi.com.my
URL: https://ratusanpaksi.com.my/A/Asb/index.htm
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.187 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
d0f9fcead3b420bf003b420818181a7428accd2d7c2340297c3a03135f19d4d4
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' www.google-analytics.com stats.g.doubleclick.net *.google.com *.gstatic.com *.asbbank.co.nz *.asb.co.nz asbbankltd.tt.omtrdc.net dpm.demdex.net asb.demdex.net cm.everesttech.net;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ratusanpaksi.com.my/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' www.google-analytics.com stats.g.doubleclick.net *.google.com *.gstatic.com *.asbbank.co.nz *.asb.co.nz asbbankltd.tt.omtrdc.net dpm.demdex.net asb.demdex.net cm.everesttech.net;
content-encoding
gzip
x-content-type-options
nosniff
p3p
CP="NON CUR OTPi OUR NOR UNI"
vary
Accept-Encoding
content-length
758
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Tue, 03 Nov 2020 22:46:18 GMT
x-frame-options
SAMEORIGIN
date
Mon, 03 Jan 2022 17:10:26 GMT
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript
cache-control
private, max-age=130270
etag
W/"1611-1604443578000"
accept-ranges
bytes
expires
Wed, 05 Jan 2022 05:21:36 GMT
lock.png
online.asb.co.nz/auth/icons/
969 B
1 KB
Image
General
Full URL
https://online.asb.co.nz/auth/icons/lock.png
Requested by
Host: online.asb.co.nz
URL: https://online.asb.co.nz/auth/css/screen.min.css?v=1.0.5.5
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.187 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
646656303adc02768f47ea038e70cab0ccd359d395f25b7cccdcd519b784d395
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' www.google-analytics.com stats.g.doubleclick.net *.google.com *.gstatic.com *.asbbank.co.nz *.asb.co.nz asbbankltd.tt.omtrdc.net dpm.demdex.net asb.demdex.net cm.everesttech.net;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://online.asb.co.nz/auth/css/screen.min.css?v=1.0.5.5
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' www.google-analytics.com stats.g.doubleclick.net *.google.com *.gstatic.com *.asbbank.co.nz *.asb.co.nz asbbankltd.tt.omtrdc.net dpm.demdex.net asb.demdex.net cm.everesttech.net;
x-content-type-options
nosniff
p3p
CP="NON CUR OTPi OUR NOR UNI"
content-length
969
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
last-modified
Tue, 03 Nov 2020 22:46:18 GMT
x-frame-options
SAMEORIGIN
date
Mon, 03 Jan 2022 17:10:26 GMT
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/png
cache-control
private, max-age=169992
etag
W/"969-1604443578000"
accept-ranges
bytes
expires
Wed, 05 Jan 2022 16:23:38 GMT
unchecked.png
online.asb.co.nz/auth/icons/
322 B
857 B
Image
General
Full URL
https://online.asb.co.nz/auth/icons/unchecked.png
Requested by
Host: online.asb.co.nz
URL: https://online.asb.co.nz/auth/css/screen.min.css?v=1.0.5.5
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.187 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
24f8fbe50b94b874c9354dbfd21803bbf16b0374e09b2c3dbbeaff77f8a7f771
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' www.google-analytics.com stats.g.doubleclick.net *.google.com *.gstatic.com *.asbbank.co.nz *.asb.co.nz asbbankltd.tt.omtrdc.net dpm.demdex.net asb.demdex.net cm.everesttech.net;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://online.asb.co.nz/auth/css/screen.min.css?v=1.0.5.5
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' www.google-analytics.com stats.g.doubleclick.net *.google.com *.gstatic.com *.asbbank.co.nz *.asb.co.nz asbbankltd.tt.omtrdc.net dpm.demdex.net asb.demdex.net cm.everesttech.net;
x-content-type-options
nosniff
p3p
CP="NON CUR OTPi OUR NOR UNI"
content-length
322
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
last-modified
Tue, 03 Nov 2020 22:46:18 GMT
x-frame-options
SAMEORIGIN
date
Mon, 03 Jan 2022 17:10:26 GMT
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/png
cache-control
private, max-age=169957
etag
W/"322-1604443578000"
accept-ranges
bytes
expires
Wed, 05 Jan 2022 16:23:03 GMT
chevron-down.png
online.asb.co.nz/auth/icons/
312 B
847 B
Image
General
Full URL
https://online.asb.co.nz/auth/icons/chevron-down.png
Requested by
Host: online.asb.co.nz
URL: https://online.asb.co.nz/auth/css/screen.min.css?v=1.0.5.5
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.187 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
800b76de2e6933c2021bdc480f7ee4e5babb6bbb6e0975aec786faa7daf56b92
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' www.google-analytics.com stats.g.doubleclick.net *.google.com *.gstatic.com *.asbbank.co.nz *.asb.co.nz asbbankltd.tt.omtrdc.net dpm.demdex.net asb.demdex.net cm.everesttech.net;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://online.asb.co.nz/auth/css/screen.min.css?v=1.0.5.5
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' www.google-analytics.com stats.g.doubleclick.net *.google.com *.gstatic.com *.asbbank.co.nz *.asb.co.nz asbbankltd.tt.omtrdc.net dpm.demdex.net asb.demdex.net cm.everesttech.net;
x-content-type-options
nosniff
p3p
CP="NON CUR OTPi OUR NOR UNI"
content-length
312
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
last-modified
Tue, 03 Nov 2020 22:46:18 GMT
x-frame-options
SAMEORIGIN
date
Mon, 03 Jan 2022 17:10:26 GMT
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/png
cache-control
private, max-age=170033
etag
W/"312-1604443578000"
accept-ranges
bytes
expires
Wed, 05 Jan 2022 16:24:19 GMT
recaptcha__en.js
www.gstatic.com/recaptcha/releases/VZKEDW9wslPbEc9RmzMqaOAP/
344 KB
135 KB
Script
General
Full URL
https://www.gstatic.com/recaptcha/releases/VZKEDW9wslPbEc9RmzMqaOAP/recaptcha__en.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?onload=onloadCallback&render=explicit&hl=en
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
de40f8e9a13821460fad3250442ee45458a1073661d67758f325b3a354995dd3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ratusanpaksi.com.my/
Origin
https://ratusanpaksi.com.my
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Mon, 03 Jan 2022 13:28:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
13319
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
137533
x-xss-protection
0
last-modified
Mon, 13 Dec 2021 05:04:24 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin-allow-popups; report-to="recaptcha"
expires
Tue, 03 Jan 2023 13:28:27 GMT
profile.png
online.asb.co.nz/auth/icons/
1 KB
2 KB
Image
General
Full URL
https://online.asb.co.nz/auth/icons/profile.png
Requested by
Host: online.asb.co.nz
URL: https://online.asb.co.nz/auth/css/screen.min.css?v=1.0.5.5
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.187 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e30dc7bb52f66276c5e6723cb0b6c8f083059e2f654c106ea47e7db8ff663644
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' www.google-analytics.com stats.g.doubleclick.net *.google.com *.gstatic.com *.asbbank.co.nz *.asb.co.nz asbbankltd.tt.omtrdc.net dpm.demdex.net asb.demdex.net cm.everesttech.net;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://online.asb.co.nz/auth/css/screen.min.css?v=1.0.5.5
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' www.google-analytics.com stats.g.doubleclick.net *.google.com *.gstatic.com *.asbbank.co.nz *.asb.co.nz asbbankltd.tt.omtrdc.net dpm.demdex.net asb.demdex.net cm.everesttech.net;
x-content-type-options
nosniff
p3p
CP="NON CUR OTPi OUR NOR UNI"
content-length
1532
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
last-modified
Tue, 03 Nov 2020 22:46:18 GMT
x-frame-options
SAMEORIGIN
date
Mon, 03 Jan 2022 17:10:26 GMT
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/png
cache-control
private, max-age=170103
etag
W/"1532-1604443578000"
accept-ranges
bytes
expires
Wed, 05 Jan 2022 16:25:29 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ASB Bank (Banking)

49 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| Modernizr object| html5 function| yepnope function| hex_sha1 function| b64_sha1 function| any_sha1 function| hex_hmac_sha1 function| b64_hmac_sha1 function| any_hmac_sha1 function| sha1_vm_test function| rstr_sha1 function| rstr_hmac_sha1 function| rstr2hex function| rstr2b64 function| rstr2any function| str2rstr_utf8 function| str2rstr_utf16le function| str2rstr_utf16be function| rstr2binb function| binb2rstr function| binb_sha1 function| sha1_ft function| sha1_kt function| safe_add function| bit_rol number| hexcase string| b64pad function| $ function| jQuery function| popupManagerRegisterNS object| ASB function| custFontSize function| _ function| onloadCallback object| MarketingConfig object| antiClickjack object| loginConfig function| getCookie string| warningString function| LoadMarketing object| jQuery111006738177664371048 number| intFontSize number| currentFontSize number| c_start object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client object| recaptcha

1 Cookies

Domain/Path Name / Value
ratusanpaksi.com.my/ Name: IV_JCT
Value: %2Fauth