signin.bnz.login.co.nz.1tr.cloudns.nz Open in urlscan Pro
108.165.237.187 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://signin.bnz.login.co.nz.1tr.cloudns.nz/
Effective URL:
https://signin.bnz.login.co.nz.1tr.cloudns.nz/secure/home.php?&lQEcbYl4kgiIPdZRIEwBc2t7TUUgTZLteNfneq9bPjN8syqvgmqB2ew0xBz8myKOIcgWViErsux1D8i...
Submission: On December 29 via manual (December 29th 2023, 7:53:33 pm UTC) from AU — Scanned from NZ

Summary HTTP 9 Redirects Links 7 Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 108.165.237.187, located in United States and belongs to RELIABLESITE, US. The main domain is signin.bnz.login.co.nz.1tr.cloudns.nz.
TLS certificate: Issued by ZeroSSL RSA Domain Secure Site CA on December 27th 2023. Valid for: 3 months.

This is the only time signin.bnz.login.co.nz.1tr.cloudns.nz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BNZ Bank (Banking)

Domain & IP information

	IP Address		AS Autonomous System
2 11	108.165.237.187 108.165.237.187		23470 (RELIABLESITE) (RELIABLESITE)
9	1

11 108.165.237.187 (United States) 2 redirects

ASN23470 (RELIABLESITE, US)

signin.bnz.login.co.nz.1tr.cloudns.nz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	cloudns.nz 2 redirects signin.bnz.login.co.nz.1tr.cloudns.nz	60 KB
9	1

	Domain	Requested by
11	signin.bnz.login.co.nz.1tr.cloudns.nz	2 redirects signin.bnz.login.co.nz.1tr.cloudns.nz
9	1

This site contains links to these domains. Also see Links.

Domain
www.bnz.co.nz
secure.bnz.co.nz
wealthnet.bnz.co.nz

Subject Issuer	Validity	Valid
signin.bnz.login.co.nz.1tr.cloudns.nz ZeroSSL RSA Domain Secure Site CA	`2023-12-27` - `2024-03-26`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://signin.bnz.login.co.nz.1tr.cloudns.nz/secure/home.php?&lQEcbYl4kgiIPdZRIEwBc2t7TUUgTZLteNfneq9bPjN8syqvgmqB2ew0xBz8myKOIcgWViErsux1D8ilc52eYr5p1eq4PC44YMHvtDe9KAECe3hEVWV4hKKr5bu6PFqhqZWEii9bFsiKFYvqVJJOaYt0gcDHvqIf4t4UjfjpKril7F7mxOXuP4XtVVUcGFh8E7aR08w0
Frame ID: 836CB92154F5972B5D81014D6DF9A2D9
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

BNZ LoginBNZ Logo

Page URL History Show full URLs

https://signin.bnz.login.co.nz.1tr.cloudns.nz/ HTTP 302
https://signin.bnz.login.co.nz.1tr.cloudns.nz/secure/ HTTP 302
https://signin.bnz.login.co.nz.1tr.cloudns.nz/secure/home.php?&lQEcbYl4kgiIPdZRIEwBc2t7TUUgTZLteNfneq9bPjN8syqvgmqB2ew0xBz... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

59 kB
Transfer

58 kB
Size

1
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: https://www.bnz.co.nz/
Title: BNZ Logo

Search URL Search Domain Scan URL

URL: https://secure.bnz.co.nz/auth/personal-login
Title: Current PagePersonal Banking

Search URL Search Domain Scan URL

URL: https://secure.bnz.co.nz/auth/business-login
Title: Business

Search URL Search Domain Scan URL

URL: https://www.bnz.co.nz/cfs/app/login
Title: Client Fund Service

Search URL Search Domain Scan URL

URL: https://wealthnet.bnz.co.nz/
Title: WealthNet

Search URL Search Domain Scan URL

URL: https://www.bnz.co.nz/registration/ib/app/register
Title: Register

Search URL Search Domain Scan URL

URL: https://secure.bnz.co.nz/rp
Title: Forgot your password?

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://signin.bnz.login.co.nz.1tr.cloudns.nz/ HTTP 302
https://signin.bnz.login.co.nz.1tr.cloudns.nz/secure/ HTTP 302
https://signin.bnz.login.co.nz.1tr.cloudns.nz/secure/home.php?&lQEcbYl4kgiIPdZRIEwBc2t7TUUgTZLteNfneq9bPjN8syqvgmqB2ew0xBz8myKOIcgWViErsux1D8ilc52eYr5p1eq4PC44YMHvtDe9KAECe3hEVWV4hKKr5bu6PFqhqZWEii9bFsiKFYvqVJJOaYt0gcDHvqIf4t4UjfjpKril7F7mxOXuP4XtVVUcGFh8E7aR08w0 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request home.php Show response signin.bnz.login.co.nz.1tr.cloudns.nz/secure/ Redirect Chain https://signin.bnz.login.co.nz.1tr.cloudns.nz/ https://signin.bnz.login.co.nz.1tr.cloudns.nz/secure/ https://signin.bnz.login.co.nz.1tr.cloudns.nz/secure/home.php?&lQEcbYl4kgiIPdZRIEwBc2t7TUUgTZLteNfneq9bPjN8syqvgmqB2ew0xBz8myKOIcgWViErsux1D8ilc52eYr5p1eq4PC44YMHvtDe9KAECe3hEVWV4hKKr5bu6PFqhqZWEii...	54 KB 54 KB	558ms 558ms	Document text/html	108.165.237.187 RELIABLESITE
General Check archive.org Show headers Download Go to Full URL https://signin.bnz.login.co.nz.1tr.cloudns.nz/secure/home.php?&lQEcbYl4kgiIPdZRIEwBc2t7TUUgTZLteNfneq9bPjN8syqvgmqB2ew0xBz8myKOIcgWViErsux1D8ilc52eYr5p1eq4PC44YMHvtDe9KAECe3hEVWV4hKKr5bu6PFqhqZWEii9bFsiKFYvqVJJOaYt0gcDHvqIf4t4UjfjpKril7F7mxOXuP4XtVVUcGFh8E7aR08w0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 108.165.237.187 , United States, ASN23470 (RELIABLESITE, US), Reverse DNS Software Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 / PHP/8.0.30 Resource Hash `e92543556fedfd14754d07e42528c79d8ffbdfacc7d847dc8ad0c94bd6339c93` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 accept-language en-NZ,en;q=0.9 Response headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Fri, 29 Dec 2023 19:53:26 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=98 Pragma no-cache Server Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Transfer-Encoding chunked X-Powered-By PHP/8.0.30 Redirect headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Length 0 Content-Type text/html; charset=UTF-8 Date Fri, 29 Dec 2023 19:53:25 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=99 Pragma no-cache Server Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 X-Powered-By PHP/8.0.30 location home.php?&lQEcbYl4kgiIPdZRIEwBc2t7TUUgTZLteNfneq9bPjN8syqvgmqB2ew0xBz8myKOIcgWViErsux1D8ilc52eYr5p1eq4PC44YMHvtDe9KAECe3hEVWV4hKKr5bu6PFqhqZWEii9bFsiKFYvqVJJOaYt0gcDHvqIf4t4UjfjpKril7F7mxOXuP4XtVVUcGFh8E7aR08w0
GET H/1.1	200 OK	serrano.css signin.bnz.login.co.nz.1tr.cloudns.nz/secure/index_files/	2 KB 3 KB	316ms 315ms	Stylesheet text/css	108.165.237.187 RELIABLESITE
General Check archive.org Show headers Download Go to Full URL https://signin.bnz.login.co.nz.1tr.cloudns.nz/secure/index_files/serrano.css Requested by Host: signin.bnz.login.co.nz.1tr.cloudns.nz URL: https://signin.bnz.login.co.nz.1tr.cloudns.nz/secure/home.php?&lQEcbYl4kgiIPdZRIEwBc2t7TUUgTZLteNfneq9bPjN8syqvgmqB2ew0xBz8myKOIcgWViErsux1D8ilc52eYr5p1eq4PC44YMHvtDe9KAECe3hEVWV4hKKr5bu6PFqhqZWEii9bFsiKFYvqVJJOaYt0gcDHvqIf4t4UjfjpKril7F7mxOXuP4XtVVUcGFh8E7aR08w0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 108.165.237.187 , United States, ASN23470 (RELIABLESITE, US), Reverse DNS Software Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 / Resource Hash `f8260d7d44cfb1f8029f9a65067d76476106c2dbf95aab7673a51198ca6b9659` Request headers accept-language en-NZ,en;q=0.9 Referer https://signin.bnz.login.co.nz.1tr.cloudns.nz/secure/home.php?&lQEcbYl4kgiIPdZRIEwBc2t7TUUgTZLteNfneq9bPjN8syqvgmqB2ew0xBz8myKOIcgWViErsux1D8ilc52eYr5p1eq4PC44YMHvtDe9KAECe3hEVWV4hKKr5bu6PFqhqZWEii9bFsiKFYvqVJJOaYt0gcDHvqIf4t4UjfjpKril7F7mxOXuP4XtVVUcGFh8E7aR08w0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Date Fri, 29 Dec 2023 19:53:26 GMT Last-Modified Fri, 07 Feb 2020 20:04:56 GMT Server Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 ETag "976-59e01e7488a00" Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 2422
GET H/1.1	200 OK	log.PNG signin.bnz.login.co.nz.1tr.cloudns.nz/secure/index_files/	1 KB 2 KB	317ms 316ms	Image image/png	108.165.237.187 RELIABLESITE
General Check archive.org Show headers Download Go to Show image Full URL https://signin.bnz.login.co.nz.1tr.cloudns.nz/secure/index_files/log.PNG Requested by Host: signin.bnz.login.co.nz.1tr.cloudns.nz URL: https://signin.bnz.login.co.nz.1tr.cloudns.nz/secure/home.php?&lQEcbYl4kgiIPdZRIEwBc2t7TUUgTZLteNfneq9bPjN8syqvgmqB2ew0xBz8myKOIcgWViErsux1D8ilc52eYr5p1eq4PC44YMHvtDe9KAECe3hEVWV4hKKr5bu6PFqhqZWEii9bFsiKFYvqVJJOaYt0gcDHvqIf4t4UjfjpKril7F7mxOXuP4XtVVUcGFh8E7aR08w0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 108.165.237.187 , United States, ASN23470 (RELIABLESITE, US), Reverse DNS Software Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 / Resource Hash `97bddf34276380eb5e9226e84037a2c443826635af0da8866de14908f5357402` Request headers accept-language en-NZ,en;q=0.9 Referer https://signin.bnz.login.co.nz.1tr.cloudns.nz/secure/home.php?&lQEcbYl4kgiIPdZRIEwBc2t7TUUgTZLteNfneq9bPjN8syqvgmqB2ew0xBz8myKOIcgWViErsux1D8ilc52eYr5p1eq4PC44YMHvtDe9KAECe3hEVWV4hKKr5bu6PFqhqZWEii9bFsiKFYvqVJJOaYt0gcDHvqIf4t4UjfjpKril7F7mxOXuP4XtVVUcGFh8E7aR08w0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Date Fri, 29 Dec 2023 19:53:27 GMT Last-Modified Fri, 11 Mar 2022 10:24:30 GMT Server Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 ETag "4fc-5d9eebc691380" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 1276
GET H/1.1	404 Not Found	2.js signin.bnz.login.co.nz.1tr.cloudns.nz/secure/index_files/	0 0	317ms 316ms	Script text/html	108.165.237.187 RELIABLESITE
General Check archive.org Show headers Download Go to Full URL https://signin.bnz.login.co.nz.1tr.cloudns.nz/secure/index_files/2.js Requested by Host: signin.bnz.login.co.nz.1tr.cloudns.nz URL: https://signin.bnz.login.co.nz.1tr.cloudns.nz/secure/home.php?&lQEcbYl4kgiIPdZRIEwBc2t7TUUgTZLteNfneq9bPjN8syqvgmqB2ew0xBz8myKOIcgWViErsux1D8ilc52eYr5p1eq4PC44YMHvtDe9KAECe3hEVWV4hKKr5bu6PFqhqZWEii9bFsiKFYvqVJJOaYt0gcDHvqIf4t4UjfjpKril7F7mxOXuP4XtVVUcGFh8E7aR08w0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 108.165.237.187 , United States, ASN23470 (RELIABLESITE, US), Reverse DNS Software Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 / Resource Hash Request headers accept-language en-NZ,en;q=0.9 Referer https://signin.bnz.login.co.nz.1tr.cloudns.nz/secure/home.php?&lQEcbYl4kgiIPdZRIEwBc2t7TUUgTZLteNfneq9bPjN8syqvgmqB2ew0xBz8myKOIcgWViErsux1D8ilc52eYr5p1eq4PC44YMHvtDe9KAECe3hEVWV4hKKr5bu6PFqhqZWEii9bFsiKFYvqVJJOaYt0gcDHvqIf4t4UjfjpKril7F7mxOXuP4XtVVUcGFh8E7aR08w0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Date Fri, 29 Dec 2023 19:53:27 GMT Server Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Connection Keep-Alive Keep-Alive timeout=5, max=99 Content-Length 324 Content-Type text/html; charset=iso-8859-1
GET H/1.1	404 Not Found	main.js signin.bnz.login.co.nz.1tr.cloudns.nz/secure/index_files/	0 0	948ms 315ms	Script text/html	108.165.237.187 RELIABLESITE
General Check archive.org Show headers Download Go to Full URL https://signin.bnz.login.co.nz.1tr.cloudns.nz/secure/index_files/main.js Requested by Host: signin.bnz.login.co.nz.1tr.cloudns.nz URL: https://signin.bnz.login.co.nz.1tr.cloudns.nz/secure/home.php?&lQEcbYl4kgiIPdZRIEwBc2t7TUUgTZLteNfneq9bPjN8syqvgmqB2ew0xBz8myKOIcgWViErsux1D8ilc52eYr5p1eq4PC44YMHvtDe9KAECe3hEVWV4hKKr5bu6PFqhqZWEii9bFsiKFYvqVJJOaYt0gcDHvqIf4t4UjfjpKril7F7mxOXuP4XtVVUcGFh8E7aR08w0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 108.165.237.187 , United States, ASN23470 (RELIABLESITE, US), Reverse DNS Software Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 / Resource Hash Request headers accept-language en-NZ,en;q=0.9 Referer https://signin.bnz.login.co.nz.1tr.cloudns.nz/secure/home.php?&lQEcbYl4kgiIPdZRIEwBc2t7TUUgTZLteNfneq9bPjN8syqvgmqB2ew0xBz8myKOIcgWViErsux1D8ilc52eYr5p1eq4PC44YMHvtDe9KAECe3hEVWV4hKKr5bu6PFqhqZWEii9bFsiKFYvqVJJOaYt0gcDHvqIf4t4UjfjpKril7F7mxOXuP4XtVVUcGFh8E7aR08w0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Date Fri, 29 Dec 2023 19:53:28 GMT Server Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Connection Keep-Alive Keep-Alive timeout=5, max=100 Content-Length 324 Content-Type text/html; charset=iso-8859-1
GET H/1.1	404 Not Found	SerranoWeb-Bold.woff2 signin.bnz.login.co.nz.1tr.cloudns.nz/secure/index_files/fonts/	0 0	633ms 317ms	Font text/html	108.165.237.187 RELIABLESITE
General Check archive.org Show headers Download Go to Full URL https://signin.bnz.login.co.nz.1tr.cloudns.nz/secure/index_files/fonts/SerranoWeb-Bold.woff2?v=1c25c2c065 Requested by Host: signin.bnz.login.co.nz.1tr.cloudns.nz URL: https://signin.bnz.login.co.nz.1tr.cloudns.nz/secure/index_files/serrano.css Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 108.165.237.187 , United States, ASN23470 (RELIABLESITE, US), Reverse DNS Software Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 / Resource Hash Request headers Referer https://signin.bnz.login.co.nz.1tr.cloudns.nz/secure/index_files/serrano.css Origin https://signin.bnz.login.co.nz.1tr.cloudns.nz accept-language en-NZ,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Date Fri, 29 Dec 2023 19:53:27 GMT Server Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Connection Keep-Alive Keep-Alive timeout=5, max=98 Content-Length 324 Content-Type text/html; charset=iso-8859-1
GET H/1.1	404 Not Found	SerranoWeb-Regular.woff2 signin.bnz.login.co.nz.1tr.cloudns.nz/secure/index_files/fonts/	0 0	634ms 317ms	Font text/html	108.165.237.187 RELIABLESITE
General Check archive.org Show headers Download Go to Full URL https://signin.bnz.login.co.nz.1tr.cloudns.nz/secure/index_files/fonts/SerranoWeb-Regular.woff2?v=5b6826770c Requested by Host: signin.bnz.login.co.nz.1tr.cloudns.nz URL: https://signin.bnz.login.co.nz.1tr.cloudns.nz/secure/index_files/serrano.css Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 108.165.237.187 , United States, ASN23470 (RELIABLESITE, US), Reverse DNS Software Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 / Resource Hash Request headers Referer https://signin.bnz.login.co.nz.1tr.cloudns.nz/secure/index_files/serrano.css Origin https://signin.bnz.login.co.nz.1tr.cloudns.nz accept-language en-NZ,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Date Fri, 29 Dec 2023 19:53:27 GMT Server Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Connection Keep-Alive Keep-Alive timeout=5, max=96 Content-Length 324 Content-Type text/html; charset=iso-8859-1
GET H/1.1	404 Not Found	SerranoWeb-Bold.woff signin.bnz.login.co.nz.1tr.cloudns.nz/secure/index_files/fonts/	0 0	317ms 316ms	Font text/html	108.165.237.187 RELIABLESITE
General Check archive.org Show headers Download Go to Full URL https://signin.bnz.login.co.nz.1tr.cloudns.nz/secure/index_files/fonts/SerranoWeb-Bold.woff?v=76b2d97853 Requested by Host: signin.bnz.login.co.nz.1tr.cloudns.nz URL: https://signin.bnz.login.co.nz.1tr.cloudns.nz/secure/index_files/serrano.css Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 108.165.237.187 , United States, ASN23470 (RELIABLESITE, US), Reverse DNS Software Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 / Resource Hash Request headers Referer https://signin.bnz.login.co.nz.1tr.cloudns.nz/secure/index_files/serrano.css Origin https://signin.bnz.login.co.nz.1tr.cloudns.nz accept-language en-NZ,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Date Fri, 29 Dec 2023 19:53:28 GMT Server Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Connection Keep-Alive Keep-Alive timeout=5, max=97 Content-Length 324 Content-Type text/html; charset=iso-8859-1
GET H/1.1	404 Not Found	SerranoWeb-Regular.woff signin.bnz.login.co.nz.1tr.cloudns.nz/secure/index_files/fonts/	0 0	317ms 316ms	Font text/html	108.165.237.187 RELIABLESITE
General Check archive.org Show headers Download Go to Full URL https://signin.bnz.login.co.nz.1tr.cloudns.nz/secure/index_files/fonts/SerranoWeb-Regular.woff?v=f376ea958d Requested by Host: signin.bnz.login.co.nz.1tr.cloudns.nz URL: https://signin.bnz.login.co.nz.1tr.cloudns.nz/secure/index_files/serrano.css Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 108.165.237.187 , United States, ASN23470 (RELIABLESITE, US), Reverse DNS Software Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 / Resource Hash Request headers Referer https://signin.bnz.login.co.nz.1tr.cloudns.nz/secure/index_files/serrano.css Origin https://signin.bnz.login.co.nz.1tr.cloudns.nz accept-language en-NZ,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Date Fri, 29 Dec 2023 19:53:28 GMT Server Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Connection Keep-Alive Keep-Alive timeout=5, max=100 Content-Length 324 Content-Type text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BNZ Bank (Banking)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture object| webpackJsonp@bnz/online-login-client

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			signin.bnz.login.co.nz.1tr.cloudns.nz/	1969-12-31 23:59:59	Name: PHPSESSID Value: 4kser5j4b8ceee59ugrrinqpp8

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://signin.bnz.login.co.nz.1tr.cloudns.nz/secure/index_files/2.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://signin.bnz.login.co.nz.1tr.cloudns.nz/secure/index_files/fonts/SerranoWeb-Bold.woff2?v=1c25c2c065 Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://signin.bnz.login.co.nz.1tr.cloudns.nz/secure/index_files/fonts/SerranoWeb-Regular.woff2?v=5b6826770c Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://signin.bnz.login.co.nz.1tr.cloudns.nz/secure/index_files/main.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://signin.bnz.login.co.nz.1tr.cloudns.nz/secure/index_files/fonts/SerranoWeb-Bold.woff?v=76b2d97853 Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://signin.bnz.login.co.nz.1tr.cloudns.nz/secure/index_files/fonts/SerranoWeb-Regular.woff?v=f376ea958d Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

signin.bnz.login.co.nz.1tr.cloudns.nz
108.165.237.187
97bddf34276380eb5e9226e84037a2c443826635af0da8866de14908f5357402
e92543556fedfd14754d07e42528c79d8ffbdfacc7d847dc8ad0c94bd6339c93
f8260d7d44cfb1f8029f9a65067d76476106c2dbf95aab7673a51198ca6b9659

signin.bnz.login.co.nz.1tr.cloudns.nz Open in urlscan Pro 108.165.237.187 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

59 kBTransfer

58 kBSize

1 Cookies

7 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

1 Cookies

6 Console Messages

Indicators

signin.bnz.login.co.nz.1tr.cloudns.nz Open in urlscan Pro
108.165.237.187 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

59 kB
Transfer

58 kB
Size

1
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!