personal.bnz.co.ew.cloudns.nz
Open in
urlscan Pro
108.165.237.187
Malicious Activity!
Public Scan
Submission: On December 20 via manual from AU — Scanned from NZ
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on December 19th 2023. Valid for: 3 months.
This is the only time personal.bnz.co.ew.cloudns.nz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: BNZ Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
9 | 108.165.237.187 108.165.237.187 | 23470 (RELIABLESITE) (RELIABLESITE) | |
9 | 1 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
cloudns.nz
personal.bnz.co.ew.cloudns.nz |
59 KB |
9 | 1 |
Domain | Requested by | |
---|---|---|
9 | personal.bnz.co.ew.cloudns.nz |
personal.bnz.co.ew.cloudns.nz
|
9 | 1 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.bnz.co.nz |
secure.bnz.co.nz |
wealthnet.bnz.co.nz |
Subject Issuer | Validity | Valid | |
---|---|---|---|
personal.bnz.co.ew.cloudns.nz Sectigo RSA Domain Validation Secure Server CA |
2023-12-19 - 2024-03-18 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://personal.bnz.co.ew.cloudns.nz/secure/home.php?&tMbIGLTRJqlwCu2pgbBfZ1YmM4ytCSdpvrBMxIzBN9xtOEXpUyIx5C6yF3w2qmxxwo8pjUphE6RL2iLXBDZzjRMuOkLcYXGoy1DOhk0F6eYYc3yXNKjlTUuERPIw29JhNd3IHa0MZLVBSWkGK4HhKEcMMtlqtLcBj3vkfazwJtKfp7Z9OxHuGVARKUn5tcvayfSmuBH1
Frame ID: E31E6E55B80CB6E61702BDF5A419BF0B
Requests: 9 HTTP requests in this frame
7 Outgoing links
These are links going to different origins than the main page.
Title: BNZ Logo
Search URL Search Domain Scan URL
Title: Current PagePersonal Banking
Search URL Search Domain Scan URL
Title: Business
Search URL Search Domain Scan URL
Title: Client Fund Service
Search URL Search Domain Scan URL
Title: WealthNet
Search URL Search Domain Scan URL
Title: Register
Search URL Search Domain Scan URL
Title: Forgot your password?
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
home.php
personal.bnz.co.ew.cloudns.nz/secure/ |
54 KB 54 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
serrano.css
personal.bnz.co.ew.cloudns.nz/secure/index_files/ |
2 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
log.PNG
personal.bnz.co.ew.cloudns.nz/secure/index_files/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
2.js
personal.bnz.co.ew.cloudns.nz/secure/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.js
personal.bnz.co.ew.cloudns.nz/secure/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
SerranoWeb-Bold.woff2
personal.bnz.co.ew.cloudns.nz/secure/index_files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
SerranoWeb-Regular.woff2
personal.bnz.co.ew.cloudns.nz/secure/index_files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
SerranoWeb-Bold.woff
personal.bnz.co.ew.cloudns.nz/secure/index_files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
SerranoWeb-Regular.woff
personal.bnz.co.ew.cloudns.nz/secure/index_files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: BNZ Bank (Banking)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture object| webpackJsonp@bnz/online-login-client1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
personal.bnz.co.ew.cloudns.nz/ | Name: PHPSESSID Value: 5u2j16kceutsettvs39io7umto |
6 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
personal.bnz.co.ew.cloudns.nz
108.165.237.187
97bddf34276380eb5e9226e84037a2c443826635af0da8866de14908f5357402
e92543556fedfd14754d07e42528c79d8ffbdfacc7d847dc8ad0c94bd6339c93
f8260d7d44cfb1f8029f9a65067d76476106c2dbf95aab7673a51198ca6b9659