anz.netbanking4.com
Open in
urlscan Pro
167.88.164.108
Malicious Activity!
Public Scan
Submission: On May 19 via manual from AU — Scanned from AU
Summary
TLS certificate: Issued by R3 on May 19th 2023. Valid for: 3 months.
This is the only time anz.netbanking4.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: ANZ Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
12 | 167.88.164.108 167.88.164.108 | 29802 (HVC-AS) (HVC-AS) | |
1 | 69.16.175.10 69.16.175.10 | 20446 (STACKPATH...) (STACKPATH-CDN) | |
14 | 3 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
netbanking4.com
anz.netbanking4.com |
193 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 696 |
30 KB |
14 | 2 |
Domain | Requested by | |
---|---|---|
12 | anz.netbanking4.com |
anz.netbanking4.com
code.jquery.com |
1 | code.jquery.com |
anz.netbanking4.com
|
14 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
anz.netbanking4.com R3 |
2023-05-19 - 2023-08-17 |
3 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2022-08-03 - 2023-07-14 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://anz.netbanking4.com/azu
Frame ID: E47CABF2C8C865090A0CF4C95C078644
Requests: 14 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
azu
anz.netbanking4.com/ |
15 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.js
anz.netbanking4.com/assets/azu/ |
87 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.css
anz.netbanking4.com/assets/azu/ |
29 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.0.min.js
code.jquery.com/ |
87 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
actions.js
anz.netbanking4.com/assets/js/ |
778 B 667 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
anz-logo.1.0.0.svg
anz.netbanking4.com/assets/azu/ |
38 KB 38 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ib-login-support.1.0.0.svg
anz.netbanking4.com/assets/azu/ |
11 KB 11 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
anz-logo.1.0.0.svg
anz.netbanking4.com/assets/img/ |
31 B 31 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
MyriadPro-Semibold.1.0.0.woff
anz.netbanking4.com/assets/azu/files/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
MyriadPro-Regular.1.0.0.woff
anz.netbanking4.com/assets/azu/files/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
MyriadPro-Semibold.1.0.0.woff
anz.netbanking4.com/assets/azu/ |
52 KB 52 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
MyriadPro-Regular.1.0.0.woff
anz.netbanking4.com/assets/azu/ |
51 KB 52 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
action
anz.netbanking4.com/apis/lr/ |
25 B 338 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST |
active
anz.netbanking4.com/apis/lr/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- anz.netbanking4.com
- URL
- https://anz.netbanking4.com/apis/lr/active
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: ANZ Bank (Banking)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless function| $ function| jQuery string| lrbank string| lrinfo boolean| continueupdate1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
anz.netbanking4.com/ | Name: PHPSESSID Value: 2n0mln43urjpf0qgvajigmm0l5 |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
anz.netbanking4.com
code.jquery.com
anz.netbanking4.com
167.88.164.108
69.16.175.10
0f2f421d03f0dd094f5eeea11c1b78898bb8c38cdc6a9859627617bbb4db363e
411a7dde58e7f50627e413a47dda8ef4d5d11ec89ac4b78b8416a66badf7bd60
47f114f0136ee47696b3273c3b3f79f5debbded9db784db2ef487716f7b066c4
9af4df3b7f044525975716b175351fa75553070734627cf3b1325332284208c5
9faaeebf1bf4e267b53199c13210d51648c53c57fa6b187f5b5b5e90975e7eff
b6bf163550dd994ccb01b937f1210281ec8681bfea58b38cf92b266a3d257cfc
c1cbbd152a050ee0dc982af665d16b3508db3942527b4b1d65aff0127244ac9e
df477d03866885295a31b44c475bc6150273fc522c3bd5c1db69478650ebc2a5
f7712d669184cbf9da44b15ceacfdc3c4bbcfc683d0b7a248d823636f57748e8
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e