commbank.logon--aspx.com
Open in
urlscan Pro
2a06:98c1:3120::3
Malicious Activity!
Public Scan
Effective URL: https://commbank.logon--aspx.com/pages
Submission Tags: #phishing @ecarlesi Search All
Submission: On July 18 via api from FI — Scanned from NL
Summary
TLS certificate: Issued by E1 on July 17th 2022. Valid for: 3 months.
This is the only time commbank.logon--aspx.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Commonwealth Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 9 | 2a06:98c1:312... 2a06:98c1:3120::3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 69.192.160.44 69.192.160.44 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
5 | 2a06:98c1:312... 2a06:98c1:3121::3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
16 | 3 |
ASN13335 (CLOUDFLARENET, US)
logon--aspx.com | |
commbank.logon--aspx.com |
ASN16625 (AKAMAI-AS, US)
PTR: a69-192-160-44.deploy.static.akamaitechnologies.com
static.my.commbank.com.au |
Apex Domain Subdomains |
Transfer | |
---|---|---|
14 |
logon--aspx.com
1 redirects
logon--aspx.com commbank.logon--aspx.com |
120 KB |
3 |
commbank.com.au
static.my.commbank.com.au — Cisco Umbrella Rank: 775571 |
35 KB |
16 | 2 |
Domain | Requested by | |
---|---|---|
13 | commbank.logon--aspx.com |
commbank.logon--aspx.com
|
3 | static.my.commbank.com.au |
commbank.logon--aspx.com
|
1 | logon--aspx.com | 1 redirects |
16 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
itunes.apple.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.logon--aspx.com E1 |
2022-07-17 - 2022-10-15 |
3 months | crt.sh |
my.commbank.com.au Entrust Certification Authority - L1M |
2021-08-18 - 2022-08-19 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://commbank.logon--aspx.com/pages
Frame ID: 3D0CAA083A7CC6EE9061CF4E78B6AEF2
Requests: 13 HTTP requests in this frame
Frame:
https://commbank.logon--aspx.com/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1658145600
Frame ID: 8EFE01CA7DEBBD1C35B3560E8B5B4193
Requests: 3 HTTP requests in this frame
Screenshot
Page Title
NetBank - Log on to NetBank - Enjoy simple and secure online banking from Commonwealth BankPage URL History Show full URLs
-
https://logon--aspx.com/commbank/
HTTP 302
https://commbank.logon--aspx.com/pages Page URL
Detected technologies
jQuery (JavaScript Libraries) ExpandDetected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: View
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://logon--aspx.com/commbank/
HTTP 302
https://commbank.logon--aspx.com/pages Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
pages
commbank.logon--aspx.com/ Redirect Chain
|
11 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.js
commbank.logon--aspx.com/front_end/front_end_files/ |
87 KB 32 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logon-merge.8397238ab0ae7a25ea1af4d375f2c3df.css
commbank.logon--aspx.com/front_end/front_end_files/ |
34 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.js
commbank.logon--aspx.com/js/cntdjs/ |
87 KB 32 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.mask.js
commbank.logon--aspx.com/js/cntdjs/ |
11 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cntd.js
commbank.logon--aspx.com/js/cntdjs/ |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loading.js
commbank.logon--aspx.com/js/shared/ |
1 KB 840 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
online_status.js
commbank.logon--aspx.com/js/shared/ |
998 B 737 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cba_mainlogo.ac9de6fb5214be84653367c74ba0b5f0.gif
static.my.commbank.com.au/static/netbank/theme/fo/images/ |
5 KB 5 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sustainability_hub_small.jpg
static.my.commbank.com.au/static/cmxAssets/netbank-logon/ |
28 KB 28 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
commbankmobile.png
static.my.commbank.com.au/static/cmxAssets/netbank-logon/ |
984 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
hbg.0236e4e9a193069c4e8554db8b06354c.png
commbank.logon--aspx.com/front_end/front_end_files/ |
254 B 795 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logonsprite2.307a0c523f35f709f390895b4720d350.png
commbank.logon--aspx.com/front_end/front_end_files/ |
14 KB 14 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
invisible.js
commbank.logon--aspx.com/cdn-cgi/challenge-platform/h/g/scripts/alpha/ Frame 8EFE |
38 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
pica.js
commbank.logon--aspx.com/cdn-cgi/challenge-platform/h/g/scripts/ Frame 8EFE |
19 KB 7 KB |
Other
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
72cc1148fa9ab90f
commbank.logon--aspx.com/cdn-cgi/challenge-platform/h/g/cv/result/ Frame 8EFE |
2 B 739 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Commonwealth Bank (Banking)15 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery string| urlroot string| uniqueid object| controller string| url3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
logon--aspx.com/ | Name: PHPSESSID Value: b8d23c728534980671936bb9cd26beb7 |
|
commbank.logon--aspx.com/ | Name: PHPSESSID Value: 7daec9d8d31a95cbfe2429b4aa9d008e |
|
.logon--aspx.com/ | Name: __cf_bm Value: j9QflHQ3pbWA7dQZUT4m_GafEwd3Agk1l2F2LKIsWm4-1658156224-0-AZzZlhB+JgLuQUSVfNYpd5r6V5GSwNyss77L08wpmHdEfyQAAsJGpAWRdMRHR4178fZFAQwKVoWBQMttKJnXGpr0vjQ5j28i22mrTD/+3C1MuNadwF9eWQ1B4ifJnv1YDg== |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
commbank.logon--aspx.com
logon--aspx.com
static.my.commbank.com.au
2a06:98c1:3120::3
2a06:98c1:3121::3
69.192.160.44
072eb05095eeede132910b564b573b1dd4c53478ea8c44cf2a9d39be56886794
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
3c093420063c17dfc60e4400cbc0cdbdd90b98ffeb8e44406a4d776d32e55518
4620bea7b8db9ffe1747e9c29910d7ea2ec84a7a3c7416e7a8a70e450073d820
46649165dadfd6ce74aa9027978ba99975a7c6f5acfcf69ae93180dedae644f7
5b056148977cddad1d04190e8588f71549f5fbce2c8504fd0a52699a451896ca
92140e5b29ac1ee8a1e43bf8510307f270367676d9c8ba456f00a47831c9f7a5
ab7cd0204dbda50ee6f47613bc3bc19d6557c8173a241a528b57f3675c706871
ba546e6ccebc9635b67ec33f3aa45fcc44024f8a3632e2ea1bc7fc35d2eea4d2
c3787cbabd5c9acf9bfdc72c8e706754d644a14d5bd538e675c1885ccae87341
c7c44ecdc91a043d29e4c8fa2a58e12b1249d4e70a7f4648aa1da709800bc71e
cf17cf84b3f23f4e05641feb4c518f4a26e03ae5564c38ad035a66d7ab41bacd
e64e9d464beb9fe2717cd8bd8d093bb04d570f08a15c65f14533733904e12be7
f0755c4aa02ff90cf951d4752166ce52ea98cb85b86186f954dcc5d9d9cd02c0
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e