pr-3.link Open in urlscan Pro
202.146.220.247 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://pr-3.link/dist/
Submission: On September 16 via api (September 16th 2022, 7:07:55 am UTC) from CA — Scanned from CA

Summary HTTP 9 Redirects Links 16 Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 9 HTTP transactions. The main IP is 202.146.220.247, located in Hong Kong and belongs to SUNHK-DATA-AS-AP Sun Network Hong Kong Limited - HongKong Backbone, HK. The main domain is pr-3.link.
TLS certificate: Issued by R3 on September 15th 2022. Valid for: 3 months.

This is the only time pr-3.link was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Commonwealth Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
8	202.146.220.247 202.146.220.247	38197 (SUNHK-DAT...) (SUNHK-DATA-AS-AP Sun Network Hong Kong Limited - HongKong Backbone)
1	184.50.205.101 184.50.205.101	16625 (AKAMAI-AS) (AKAMAI-AS)
9	2

8 202.146.220.247 (Hong Kong)

ASN38197 (SUNHK-DATA-AS-AP Sun Network Hong Kong Limited - HongKong Backbone, HK)

pr-3.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 184.50.205.101 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a184-50-205-101.deploy.static.akamaitechnologies.com

static.my.commbank.com.au	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	pr-3.link pr-3.link	209 KB
1	commbank.com.au static.my.commbank.com.au — Cisco Umbrella Rank: 989575	14 KB
9	2

	Domain	Requested by
8	pr-3.link	pr-3.link
1	static.my.commbank.com.au	pr-3.link
9	2

This site contains links to these domains. Also see Links.

Domain
www.my.commbank.com.au
www1.my.commbank.com.au
www.commbank.com.au

Subject Issuer	Validity	Valid
commbaok.com R3	`2022-09-15` - `2022-12-14`	3 months	crt.sh
my.commbank.com.au Entrust Certification Authority - L1M	`2022-06-28` - `2023-07-27`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://pr-3.link/dist/
Frame ID: C71F8ECBC601A5EEEAF817EA2D2C6EC3
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

NetBank - Log on to NetBank - Enjoy simple and secure online banking from Commonwealth Bank

Detected technologies

Vue.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+\sdata-v(?:ue)?-

Page Statistics

9
Requests

11 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

223 kB
Transfer

646 kB
Size

0
Cookies

16 Outgoing links

These are links going to different origins than the main page.

URL: https://www.my.commbank.com.au/netbank/Logon/Logon.aspx#txtMyClientNumber_field
Title: Client number

Search URL Search Domain Scan URL

URL: https://www.my.commbank.com.au/netbank/Logon/Logon.aspx#txtMyPassword_field
Title: Password

Search URL Search Domain Scan URL

URL: https://www1.my.commbank.com.au/netbank/UserMaintenance/Mixed/ForgotLogonDetails/FLDYourLogonDetails.aspx?RID=kKytvMCOeUW0C-JkSY3RCw&SID=vDcqVANmJew%3d
Title: I've forgotten my log on details

Search URL Search Domain Scan URL

URL: http://www.commbank.com.au/passwordtips
Title: Find out more

Search URL Search Domain Scan URL

URL: https://www1.my.commbank.com.au/netbank/Registration/Mixed/SelectCard.aspx?RID=kKytvMCOeUW0C-JkSY3RCw&SID=vDcqVANmJew%3d
Title: Register for NetBank now

Search URL Search Domain Scan URL

URL: https://www.commbank.com.au/personal/support.html
Title: Online support for our products and services

Search URL Search Domain Scan URL

URL: http://www.commbank.com.au/security-privacy/default.aspx
Title: Tips to stay safe online

Search URL Search Domain Scan URL

URL: https://www.commbank.com.au/security-privacy/how-protect-you.html
Title: How we protect you and our 100% security guarantee

Search URL Search Domain Scan URL

URL: https://www.commbank.com.au/support/emergency-assistance.html?mbt=nb-tile_floodsEA

Search URL Search Domain Scan URL

URL: https://www.commbank.com.au/support/messaging.html?mbt=nb-tile_floodsmessaging
Title: message us

Search URL Search Domain Scan URL

URL: https://www.commbank.com.au/about-us/opportunity-initiatives/opportunity-from-community/sponsorships.html?mbt=nb-ql_sponsorships
Title: Supporting the game changers in women's sport

Search URL Search Domain Scan URL

URL: https://www.commbank.com.au/support/financial-difficulty.html?mbt=nb-ql_financialdifficulty
Title: Are you in financial difficulty? Apply for assistance.

Search URL Search Domain Scan URL

URL: https://www.commbank.com.au/digital-banking/benefits-finder.html?mbt=nb-ql_benefitsfinder
Title: Find benefits you may be eligible for during lockdown.

Search URL Search Domain Scan URL

URL: https://www.commbank.com.au/latest/support-for-home-loan-customers.html?mbt=nb-ql_supportHL
Title: Support for home loan customers

Search URL Search Domain Scan URL

URL: http://www.commbank.com.au/personal/netbank/terms-and-conditions/terms.aspx
Title: Terms of use

Search URL Search Domain Scan URL

URL: http://www.commbank.com.au/security-privacy/general-security/privacy.html
Title: Privacy

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
pr-3.link/dist/ 887 B
675 B 1097ms
537ms Document
text/html 202.146.220.247
HongKong Backbone

General

Check archive.org

Show headers Download Go to

Full URL: https://pr-3.link/dist/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 202.146.220.247 , Hong Kong, ASN38197 (SUNHK-DATA-AS-AP Sun Network Hong Kong Limited - HongKong Backbone, HK),
Reverse DNS
Software: Apache /
Resource Hash: 96178c6bd2cf49c175087a372afbb6a7db59028c33c2ad03acb84fd946b03ac7

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 537
content-type: text/html
date: Fri, 16 Sep 2022 07:07:49 GMT
etag: "377-5e816b9390680-gzip"
last-modified: Wed, 07 Sep 2022 13:59:38 GMT
server: Apache
vary: Accept-Encoding

GET
H2 200 logon-merge.8397238ab0ae7a25ea1af4d375f2c3df.css
pr-3.link/dist/login_files/ 37 KB
7 KB 237ms
236ms Stylesheet
text/css 202.146.220.247
HongKong Backbone

General

Check archive.org

Show headers Download Go to

Full URL: https://pr-3.link/dist/login_files/logon-merge.8397238ab0ae7a25ea1af4d375f2c3df.css
Requested by: Host: pr-3.link
URL: https://pr-3.link/dist/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 202.146.220.247 , Hong Kong, ASN38197 (SUNHK-DATA-AS-AP Sun Network Hong Kong Limited - HongKong Backbone, HK),
Reverse DNS
Software: Apache /
Resource Hash: 2e8ffe17dd5eec02b7d1f32ed02e9bfb9925dda8902ff79e94f9f33d3f1d03d8

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pr-3.link/dist/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 16 Sep 2022 07:07:50 GMT
content-encoding: gzip
last-modified: Tue, 06 Sep 2022 15:01:22 GMT
server: Apache
etag: "9399-5e80378283480-gzip"
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 7484

GET
H2 200 index.e2e68c0b.js Show response
pr-3.link/dist/assets/ 449 KB
130 KB 713ms
712ms Script
application/javascript 202.146.220.247
HongKong Backbone

General

Check archive.org

Show headers Download Go to

Full URL: https://pr-3.link/dist/assets/index.e2e68c0b.js
Requested by: Host: pr-3.link
URL: https://pr-3.link/dist/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 202.146.220.247 , Hong Kong, ASN38197 (SUNHK-DATA-AS-AP Sun Network Hong Kong Limited - HongKong Backbone, HK),
Reverse DNS
Software: Apache /
Resource Hash: d0b74fc8ec08a2af7bd75248e38130dc5d4a82c64c51000ab7eb1080335804f4

Request headers

Referer: https://pr-3.link/dist/
Origin: https://pr-3.link
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 16 Sep 2022 07:07:50 GMT
content-encoding: gzip
last-modified: Wed, 07 Sep 2022 13:59:38 GMT
server: Apache
etag: "7036b-5e816b9390680-gzip"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes

GET
H2 200 index.26b960fe.css
pr-3.link/dist/assets/ 113 KB
38 KB 241ms
241ms Stylesheet
text/css 202.146.220.247
HongKong Backbone

General

Check archive.org

Show headers Download Go to

Full URL: https://pr-3.link/dist/assets/index.26b960fe.css
Requested by: Host: pr-3.link
URL: https://pr-3.link/dist/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 202.146.220.247 , Hong Kong, ASN38197 (SUNHK-DATA-AS-AP Sun Network Hong Kong Limited - HongKong Backbone, HK),
Reverse DNS
Software: Apache /
Resource Hash: 679fffb9076a8f108f04e52c45b45003be8d6c3aaa1d45a0f7ef003ed9b40304

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pr-3.link/dist/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 16 Sep 2022 07:07:50 GMT
content-encoding: gzip
last-modified: Wed, 07 Sep 2022 13:59:38 GMT
server: Apache
etag: "1c3ce-5e816b9390680-gzip"
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 38753

GET
H2 404 hbg.0236e4e9a193069c4e8554db8b06354c.png
pr-3.link/dist/images/ 256 B
256 B 298ms
297ms Image
text/html 202.146.220.247
HongKong Backbone

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pr-3.link/dist/images/hbg.0236e4e9a193069c4e8554db8b06354c.png
Requested by: Host: pr-3.link
URL: https://pr-3.link/dist/login_files/logon-merge.8397238ab0ae7a25ea1af4d375f2c3df.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 202.146.220.247 , Hong Kong, ASN38197 (SUNHK-DATA-AS-AP Sun Network Hong Kong Limited - HongKong Backbone, HK),
Reverse DNS
Software: Apache /
Resource Hash: 7465978565abee0235c68ccb2dd85c725a3290ab4971f1b99b81aeff9a27b2fc

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pr-3.link/dist/login_files/logon-merge.8397238ab0ae7a25ea1af4d375f2c3df.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 16 Sep 2022 07:07:50 GMT
server: Apache
content-length: 256
content-type: text/html; charset=iso-8859-1

GET
H2 200 cba_mainlogo.ac9de6fb5214be84653367c74ba0b5f0.4620bea7.gif
pr-3.link/dist/assets/ 5 KB
5 KB 236ms
235ms Image
image/gif 202.146.220.247
HongKong Backbone

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pr-3.link/dist/assets/cba_mainlogo.ac9de6fb5214be84653367c74ba0b5f0.4620bea7.gif
Requested by: Host: pr-3.link
URL: https://pr-3.link/dist/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 202.146.220.247 , Hong Kong, ASN38197 (SUNHK-DATA-AS-AP Sun Network Hong Kong Limited - HongKong Backbone, HK),
Reverse DNS
Software: Apache /
Resource Hash: 4620bea7b8db9ffe1747e9c29910d7ea2ec84a7a3c7416e7a8a70e450073d820

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pr-3.link/dist/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 16 Sep 2022 07:07:51 GMT
last-modified: Wed, 07 Sep 2022 13:59:38 GMT
server: Apache
accept-ranges: bytes
etag: "12f4-5e816b9390680"
content-length: 4852
content-type: image/gif

GET
H2 200 nb-logon-floods.c97ab139.jpg
pr-3.link/dist/assets/ 28 KB
28 KB 244ms
244ms Image
image/jpeg 202.146.220.247
HongKong Backbone

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pr-3.link/dist/assets/nb-logon-floods.c97ab139.jpg
Requested by: Host: pr-3.link
URL: https://pr-3.link/dist/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 202.146.220.247 , Hong Kong, ASN38197 (SUNHK-DATA-AS-AP Sun Network Hong Kong Limited - HongKong Backbone, HK),
Reverse DNS
Software: Apache /
Resource Hash: c97ab139820011a8fa74366aeb672f82f7bf0295aa96478620a3c50a49e18a20

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pr-3.link/dist/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 16 Sep 2022 07:07:51 GMT
last-modified: Wed, 07 Sep 2022 13:59:38 GMT
server: Apache
accept-ranges: bytes
etag: "6ec4-5e816b9390680"
content-length: 28356
content-type: image/jpeg

GET
H/1.1 200
OK logonsprite2.307a0c523f35f709f390895b4720d350.png
static.my.commbank.com.au/static/netbank/theme/fo/images/ 14 KB
14 KB 297ms
21ms Image
image/png 184.50.205.101
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.my.commbank.com.au/static/netbank/theme/fo/images/logonsprite2.307a0c523f35f709f390895b4720d350.png

Requested by

Host: pr-3.link
URL: https://pr-3.link/dist/login_files/logon-merge.8397238ab0ae7a25ea1af4d375f2c3df.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

184.50.205.101 Edison, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-50-205-101.deploy.static.akamaitechnologies.com

Software

Resource Hash

c3787cbabd5c9acf9bfdc72c8e706754d644a14d5bd538e675c1885ccae87341

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pr-3.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date: Fri, 16 Sep 2022 07:07:51 GMT
Last-Modified: Tue, 07 Jun 2022 05:02:32 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Type: image/png
Access-Control-Allow-Origin: *
Cache-Control: public,max-age=31536000,must-revalidate,proxy-revalidate
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 14207

GET
H2 404 logonsprite2.307a0c523f35f709f390895b4720d350.png
pr-3.link/dist/images/ 256 B
256 B 549ms
548ms Image
text/html 202.146.220.247
HongKong Backbone

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pr-3.link/dist/images/logonsprite2.307a0c523f35f709f390895b4720d350.png
Requested by: Host: pr-3.link
URL: https://pr-3.link/dist/login_files/logon-merge.8397238ab0ae7a25ea1af4d375f2c3df.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 202.146.220.247 , Hong Kong, ASN38197 (SUNHK-DATA-AS-AP Sun Network Hong Kong Limited - HongKong Backbone, HK),
Reverse DNS
Software: Apache /
Resource Hash: 7465978565abee0235c68ccb2dd85c725a3290ab4971f1b99b81aeff9a27b2fc

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pr-3.link/dist/login_files/logon-merge.8397238ab0ae7a25ea1af4d375f2c3df.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 16 Sep 2022 07:07:51 GMT
server: Apache
content-length: 256
content-type: text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Commonwealth Bank (Banking)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://pr-3.link/dist/images/hbg.0236e4e9a193069c4e8554db8b06354c.png Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://pr-3.link/dist/images/logonsprite2.307a0c523f35f709f390895b4720d350.png Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

pr-3.link
static.my.commbank.com.au
184.50.205.101
202.146.220.247
2e8ffe17dd5eec02b7d1f32ed02e9bfb9925dda8902ff79e94f9f33d3f1d03d8
4620bea7b8db9ffe1747e9c29910d7ea2ec84a7a3c7416e7a8a70e450073d820
679fffb9076a8f108f04e52c45b45003be8d6c3aaa1d45a0f7ef003ed9b40304
7465978565abee0235c68ccb2dd85c725a3290ab4971f1b99b81aeff9a27b2fc
96178c6bd2cf49c175087a372afbb6a7db59028c33c2ad03acb84fd946b03ac7
c3787cbabd5c9acf9bfdc72c8e706754d644a14d5bd538e675c1885ccae87341
c97ab139820011a8fa74366aeb672f82f7bf0295aa96478620a3c50a49e18a20
d0b74fc8ec08a2af7bd75248e38130dc5d4a82c64c51000ab7eb1080335804f4

pr-3.link Open in urlscan Pro 202.146.220.247 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

9 Requests

11 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

223 kBTransfer

646 kBSize

0 Cookies

16 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

10 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

pr-3.link Open in urlscan Pro
202.146.220.247 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

11 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

223 kB
Transfer

646 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!