aa3gng2c.v.anzserving.cc
Open in
urlscan Pro
175.41.17.30
Malicious Activity!
Public Scan
Submitted URL: http://v.anzserving.cc/
Effective URL: http://aa3gng2c.v.anzserving.cc/?time=1642550895207
Submission: On January 19 via api from JP — Scanned from JP
Effective URL: http://aa3gng2c.v.anzserving.cc/?time=1642550895207
Submission: On January 19 via api from JP — Scanned from JP
Summary
This website contacted 2 IPs
in 1 countries
across 1 domains to perform 20 HTTP transactions.
The main IP is 175.41.17.30, located in
Hong Kong and
belongs to XLC-AS-AP XLC GLOBAL, HK.
The main domain is aa3gng2c.v.anzserving.cc.
This is the only time aa3gng2c.v.anzserving.cc was scanned on urlscan.io!
This is the only time aa3gng2c.v.anzserving.cc was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: ANZ Bank (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 18 | 175.41.17.30 175.41.17.30 | 9744 (XLC-AS-AP...) (XLC-AS-AP XLC GLOBAL) | |
| 20 | 2 |
18
175.41.17.30
(Hong Kong)
ASN9744 (XLC-AS-AP XLC GLOBAL, HK)
ASN9744 (XLC-AS-AP XLC GLOBAL, HK)
| v.anzserving.cc | |
| aa3gng2c.v.anzserving.cc |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 18 |
anzserving.cc
v.anzserving.cc aa3gng2c.v.anzserving.cc |
138 KB |
| 20 | 1 |
| Domain | Requested by | |
|---|---|---|
| 11 | aa3gng2c.v.anzserving.cc |
v.anzserving.cc
aa3gng2c.v.anzserving.cc |
| 7 | v.anzserving.cc |
v.anzserving.cc
|
| 20 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.recovery.anz.com |
| login.anz.com |
| register.anz.com |
| www.anz.com.au |
| Subject Issuer | Validity | Valid |
|---|
This page contains 2 frames:
Primary Page:
http://aa3gng2c.v.anzserving.cc/?time=1642550895207
Frame ID: 362225E9B6A69550D1ABBDF078BBF4F3
Requests: 19 HTTP requests in this frame
Frame:
http://aa3gng2c.v.anzserving.cc/online.asp
Frame ID: D2BB531053E8E8E5C438309DE0319D87
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- http://v.anzserving.cc/ Page URL
- http://aa3gng2c.v.anzserving.cc/?time=1642550895207 Page URL
Detected technologies
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
11 Outgoing links
These are links going to different origins than the main page.
URL: https://www.recovery.anz.com/recover/do-you-know-your-crn?target=host1&ctiId={a8757baf-0080-406b-a490-e1c58761fb9e}
Title: Forgot login details?
Title: Forgot login details?
Search URL Search Domain Scan URL
URL: https://login.anz.com/internetbanking/help
Title: Help
Title: Help
Search URL Search Domain Scan URL
URL: https://register.anz.com/internetbanking
Title: Register
Title: Register
Search URL Search Domain Scan URL
URL: https://www.anz.com.au/privacy/centre/
Title: Security and Privacy Statement.
Title: Security and Privacy Statement.
Search URL Search Domain Scan URL
URL: https://www.anz.com.au/support/?pid=glo-ibl-td-ib-04-21-ser-support
Title: Visit ANZ Support
Title: Visit ANZ Support
Search URL Search Domain Scan URL
URL: https://www.anz.com.au/ways-to-bank/internet-banking/personal/whats-new/
Title: What's new
Title: What's new
Search URL Search Domain Scan URL
URL: https://www.anz.com.au/support/customer-registration-number-password/
Title: Find or change your CRN and Password
Title: Find or change your CRN and Password
Search URL Search Domain Scan URL
URL: https://www.anz.com.au/support/statements/
Title: View statements
Title: View statements
Search URL Search Domain Scan URL
URL: https://www.anz.com.au/personal/credit-cards/using/managing/#changepin
Title: Get or change your card PIN
Title: Get or change your card PIN
Search URL Search Domain Scan URL
URL: https://www.anz.com.au/security/fraud-detection/latest-security-alerts/
Title: Latest security alerts
Title: Latest security alerts
Search URL Search Domain Scan URL
URL: https://www.anz.com.au/support/contact-us/
Title: Contact us
Title: Contact us
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://v.anzserving.cc/ Page URL
- http://aa3gng2c.v.anzserving.cc/?time=1642550895207 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
20 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
/
v.anzserving.cc/ |
27 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
drop_ip.asp
v.anzserving.cc/ |
0 409 B |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
3jitiaozhuan.js
v.anzserving.cc/ |
1 KB 1 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-1.9.1.min.js
v.anzserving.cc/app/js/ |
90 KB 32 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
layer.js
v.anzserving.cc/app/js/ |
3 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
layer.css
v.anzserving.cc/app/css/ |
7 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
anz-logo.1.0.0.svg
v.anzserving.cc/img/ |
24 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
Snipaste.png
v.anzserving.cc/img/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
ib-login-support.1.0.0.svg
v.anzserving.cc/img/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Primary Request
/
aa3gng2c.v.anzserving.cc/ |
27 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
drop_ip.asp
aa3gng2c.v.anzserving.cc/ |
0 409 B |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
3jitiaozhuan.js
aa3gng2c.v.anzserving.cc/ |
1 KB 1 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-1.9.1.min.js
aa3gng2c.v.anzserving.cc/app/js/ |
90 KB 32 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
layer.js
aa3gng2c.v.anzserving.cc/app/js/ |
3 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
layer.css
aa3gng2c.v.anzserving.cc/app/css/ |
7 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
anz-logo.1.0.0.svg
aa3gng2c.v.anzserving.cc/img/ |
38 KB 38 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Snipaste.png
aa3gng2c.v.anzserving.cc/img/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ib-login-support.1.0.0.svg
aa3gng2c.v.anzserving.cc/img/ |
11 KB 11 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
layer.css
aa3gng2c.v.anzserving.cc/app/js/need/ |
7 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
online.asp
aa3gng2c.v.anzserving.cc/ Frame D2BB |
143 B 444 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- v.anzserving.cc
- URL
- http://v.anzserving.cc/img/Snipaste.png
- Domain
- v.anzserving.cc
- URL
- http://v.anzserving.cc/img/ib-login-support.1.0.0.svg
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: ANZ Bank (Banking)15 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 function| getQueryVariable function| randomString string| time undefined| rand undefined| q undefined| host undefined| newhost undefined| href undefined| newhref function| $ function| jQuery object| layer object| netease function| getUrlParam2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| v.anzserving.cc/ | Name: ASPSESSIONIDQSAQDRRQ Value: PJKFHDDDPDHLLOGMBBKPELOD |
|
| aa3gng2c.v.anzserving.cc/ | Name: ASPSESSIONIDQSAQDRRQ Value: BKKFHDDDMOOICPJKAJIOGLLO |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
aa3gng2c.v.anzserving.cc
v.anzserving.cc
v.anzserving.cc
175.41.17.30
0f2f421d03f0dd094f5eeea11c1b78898bb8c38cdc6a9859627617bbb4db363e
20638e363fcc5152155f24b281303e17da62da62d24ef5dcf863b184d9a25734
686aed2ae006584d479d576097ba3a1889ac573f85ad59094fd8e0b7a7c2e6e1
80c6f3734ed579d0ee0b0cbb97023be6b2f931a3e07232009ecab7bad27914c8
86f39f03f5df27a6b7af2bcbf9a7cd1b329240a5b7c9b4a2776c07c712a7dfb6
bd7a73a5977d43a6d8a36b1675929e646fb55c266e8d97128a58ae5cd9b5cafc
d1e87b047c88ddb333e9be9151184a6d3c37b4350268fb2fc63f67f105b3c111
df477d03866885295a31b44c475bc6150273fc522c3bd5c1db69478650ebc2a5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e638d65e345e5dce62ec180305e47d5d5afeb05584dd031b47bc091c5771ee2c
fc4823690b726cc8fb57ed8f7af0e538936210486cb04bcbc2d1f2860bbe8e93