urlscan.io logo urlscan.io
SecurityTrails logo

funkdustvsgidsjoy.com Open in urlscan Pro
207.45.189.88  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://funkdustvsgidsjoy.com/bnzpersonal/bnz/home/index.htm
Submission: On October 01 via automatic, source openphish
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 11 HTTP transactions. The main IP is 207.45.189.88, located in Southfield, United States and belongs to ASACENET1 - ACENET, INC., US. The main domain is funkdustvsgidsjoy.com.
This is the only time funkdustvsgidsjoy.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BNZ Bank (Banking)

Domain & IP information

IP Address AS Autonomous System
2 207.45.189.88 22878 (ASACENET1)
4 34.231.140.243 14618 (AMAZON-AES)
5 45.60.78.175 19551 (INCAPSULA)
11 3
Domain Requested by
4 www.bnz.co.nz funkdustvsgidsjoy.com
4 execution-use.ci360.sas.com funkdustvsgidsjoy.com
2 funkdustvsgidsjoy.com funkdustvsgidsjoy.com
1 m.bnz.co.nz funkdustvsgidsjoy.com
11 4

This site contains links to these domains. Also see Links.

Domain
www.bnz.co.nz
Subject Issuer Validity Valid
*.ci360.sas.com
DigiCert SHA2 High Assurance Server CA		 2016-04-29 -
2019-06-27		 3 years crt.sh
www.bnz.co.nz
Entrust Certification Authority - L1M		 2018-04-05 -
2019-05-05		 a year crt.sh

This page contains 1 frames:

Primary Page: http://funkdustvsgidsjoy.com/bnzpersonal/bnz/home/index.htm
Frame ID: E5A48A8C1C265D435B7545CCE803E972
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

11
Requests

82 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

3
IPs

1
Countries

131 kB
Transfer

360 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request index.htm
funkdustvsgidsjoy.com/bnzpersonal/bnz/home/ 		37 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://funkdustvsgidsjoy.com/bnzpersonal/bnz/home/index.htm
Protocol
HTTP/1.1
Server
207.45.189.88 Southfield, United States, ASN22878 (ASACENET1 - ACENET, INC., US),
Reverse DNS
sublime-music.co.uk
Software
Apache /
Resource Hash
01bd6a45f4abede766aa31da039b9f30da9652713229f9c2b35eb2fa6199bb48
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Host
funkdustvsgidsjoy.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 01 Oct 2018 04:42:12 GMT
Server
Apache
Last-Modified
Fri, 28 Sep 2018 02:16:30 GMT
Accept-Ranges
bytes
Vary
Accept-Encoding,User-Agent
Content-Encoding
gzip
Strict-Transport-Security
max-age=31536000
Content-Length
7595
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html
ot-min.js
execution-use.ci360.sas.com/js/ 		245 KB
70 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://execution-use.ci360.sas.com/js/ot-min.js
Requested by
Host: funkdustvsgidsjoy.com
URL: http://funkdustvsgidsjoy.com/bnzpersonal/bnz/home/index.htm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.231.140.243 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-231-140-243.compute-1.amazonaws.com
Software
/
Resource Hash
40a39c1d5925a91478ff5b4f1b4045c15740115ba54d0fc3afe3a7752acc8565

Request headers

Referer
http://funkdustvsgidsjoy.com/bnzpersonal/bnz/home/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 01 Oct 2018 04:42:13 GMT
Content-Encoding
gzip
Last-Modified
Tue, 25 Sep 2018 10:03:14 GMT
ETag
W/"250801-1537869794000"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=1800, no-cache="set-cookie"
transfer-encoding
chunked
Connection
keep-alive
Accept-Ranges
bytes
Expires
Mon, 01 Oct 2018 05:12:13 GMT
1538081719195
execution-use.ci360.sas.com/t/s/c/c0b52ff90d000139628464bd/ 		25 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://execution-use.ci360.sas.com/t/s/c/c0b52ff90d000139628464bd/1538081719195?version=1.1.0&domain=secure.bnz.co.nz&vid=15f6342a75f049563bea34bb&sid=6ea48883065f68392b4c718c&hb=3820&p=%2Fauth%2Fsso-login&params=resume%3D%252Fpingfederate%252Fas%252FIbtB1%252Fresume%252Fas%252Fauthorization.ping%26spentity%3Dnull&page_title=BNZ%20Login&referrer=https%3A%2F%2Fwww.bnz.co.nz%2F&uri=https%3A%2F%2Fsecure.bnz.co.nz%2Fauth%2Fsso-login%3Fresume%3D%252Fpingfederate%252Fas%252FIbtB1%252Fresume%252Fas%252Fauthorization.ping%26spentity%3Dnull&requestedfile=%2Fauth%2Fsso-login&cts=1538081719195&tzo=-60&platform=Win32&port=&protocol=https&flash_enabled=false&flash_version=&java_enabled=false&java_version=&screen_info=1366x768@24&browser_language=en-US&character_set=UTF-8&csz=2889&bsz=1366x657&tab_id=554087139741
Requested by
Host: funkdustvsgidsjoy.com
URL: http://funkdustvsgidsjoy.com/bnzpersonal/bnz/home/index.htm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.231.140.243 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-231-140-243.compute-1.amazonaws.com
Software
/
Resource Hash
1772abf2099ca2131c60fb10f19fffe053cd710fda9e7ca943d84e84e24b5a76

Request headers

Referer
http://funkdustvsgidsjoy.com/bnzpersonal/bnz/home/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 01 Oct 2018 04:42:12 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Cache-Control
no-cache, no-cache="set-cookie"
transfer-encoding
chunked
Connection
keep-alive
Content-Type
application/javascript;charset=UTF-8
c0b52ff90d000139628464bd
execution-use.ci360.sas.com/t/s/p/ 		87 B
472 B 		Script
General
Check archive.org
Download Go to
Full URL
https://execution-use.ci360.sas.com/t/s/p/c0b52ff90d000139628464bd?version=1.1.0&domain=secure.bnz.co.nz&p=%2Fauth%2Fsso-login&params=resume%3D%252Fpingfederate%252Fas%252FIbtB1%252Fresume%252Fas%252Fauthorization.ping%26spentity%3Dnull&page_title=BNZ%20Login&referrer=https%3A%2F%2Fwww.bnz.co.nz%2F&uri=https%3A%2F%2Fsecure.bnz.co.nz%2Fauth%2Fsso-login%3Fresume%3D%252Fpingfederate%252Fas%252FIbtB1%252Fresume%252Fas%252Fauthorization.ping%26spentity%3Dnull&requestedfile=%2Fauth%2Fsso-login&platform=Win32&port=&protocol=https&browser_language=en-US&character_set=UTF-8
Requested by
Host: funkdustvsgidsjoy.com
URL: http://funkdustvsgidsjoy.com/bnzpersonal/bnz/home/index.htm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.231.140.243 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-231-140-243.compute-1.amazonaws.com
Software
/
Resource Hash
01e02a02093340071d1364f08f71d9f2c62e272ba902bbc4a01bc505f693fc1e

Request headers

Referer
http://funkdustvsgidsjoy.com/bnzpersonal/bnz/home/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 01 Oct 2018 04:42:13 GMT
Cache-Control
max-age=1800, no-cache="set-cookie"
Connection
keep-alive
Content-Length
87
Content-Type
application/javascript;charset=UTF-8
serrano.css
www.bnz.co.nz/serrano/ 		2 KB
899 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.bnz.co.nz/serrano/serrano.css
Requested by
Host: funkdustvsgidsjoy.com
URL: http://funkdustvsgidsjoy.com/bnzpersonal/bnz/home/index.htm
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
45.60.78.175 Redwood City, United States, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
Software
/
Resource Hash
f8260d7d44cfb1f8029f9a65067d76476106c2dbf95aab7673a51198ca6b9659
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
http://funkdustvsgidsjoy.com/bnzpersonal/bnz/home/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 01 Oct 2018 04:42:12 GMT
content-encoding
gzip
last-modified
Tue, 25 Sep 2018 22:08:20 GMT
x-cdn
Incapsula
etag
"976-gzip"
strict-transport-security
max-age=31536000
content-type
text/css
status
200
x-iinfo
9-17390534-0 0CNN RT(1538368932375 0) q(0 -1 -1 0) r(0 -1)
cache-control
max-age=2071542, public
content-length
472
expires
Thu, 25 Oct 2018 04:07:54 GMT
logout.png
m.bnz.co.nz/pa/oidc/ 		70 B
582 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://m.bnz.co.nz/pa/oidc/logout.png?433.73109638074595
Requested by
Host: funkdustvsgidsjoy.com
URL: http://funkdustvsgidsjoy.com/bnzpersonal/bnz/home/index.htm
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
45.60.78.175 Redwood City, United States, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
Software
/
Resource Hash
dc5687b50f70cb95379bfced5a0eae768dd4382cd6b393ee77d65bbdd6373fbf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options DENY

Request headers

Referer
http://funkdustvsgidsjoy.com/bnzpersonal/bnz/home/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000
x-cdn
Incapsula
x-frame-options
DENY
p3p
CP="CAO PSA OUR"
status
200
x-iinfo
9-17390525-17390526 NNNN CT(277 871 0) RT(1538368932086 0) q(0 0 12 0) r(15 15) U2
cache-control
private,no-cache,no-store
content-type
image/png
content-length
70
expires
0
logout.png
www.bnz.co.nz/pa/oidc/ 		70 B
502 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bnz.co.nz/pa/oidc/logout.png?78.29666129496738
Requested by
Host: funkdustvsgidsjoy.com
URL: http://funkdustvsgidsjoy.com/bnzpersonal/bnz/home/index.htm
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
45.60.78.175 Redwood City, United States, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
Software
/
Resource Hash
dc5687b50f70cb95379bfced5a0eae768dd4382cd6b393ee77d65bbdd6373fbf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options DENY

Request headers

Referer
http://funkdustvsgidsjoy.com/bnzpersonal/bnz/home/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000
x-cdn
Incapsula
x-frame-options
DENY
p3p
CP="CAO PSA OUR"
status
200
x-iinfo
9-17390535-17390536 NNNN CT(275 866 0) RT(1538368932376 0) q(0 0 12 1) r(14 14) U2
cache-control
private,no-cache,no-store
content-type
image/png
content-length
70
expires
0
c0b52ff90d000139628464bd
execution-use.ci360.sas.com/t/s/s/ 		11 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://execution-use.ci360.sas.com/t/s/s/c0b52ff90d000139628464bd
Requested by
Host: funkdustvsgidsjoy.com
URL: http://funkdustvsgidsjoy.com/bnzpersonal/bnz/home/index.htm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.231.140.243 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-231-140-243.compute-1.amazonaws.com
Software
/
Resource Hash
cfaba817dd3ef32439cf05018e5d35fc76f27e1add505dda6ed3aabbd9f46016

Request headers

Referer
http://funkdustvsgidsjoy.com/bnzpersonal/bnz/home/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 01 Oct 2018 04:42:12 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Cache-control
no-cache="set-cookie"
transfer-encoding
chunked
Connection
keep-alive
Content-Type
application/javascript;charset=ISO-8859-1
main.a88c18e8.js
funkdustvsgidsjoy.com/auth/static/js/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
http://funkdustvsgidsjoy.com/auth/static/js/main.a88c18e8.js
Requested by
Host: funkdustvsgidsjoy.com
URL: http://funkdustvsgidsjoy.com/bnzpersonal/bnz/home/index.htm
Protocol
HTTP/1.1
Server
207.45.189.88 Southfield, United States, ASN22878 (ASACENET1 - ACENET, INC., US),
Reverse DNS
sublime-music.co.uk
Software
Apache /
Resource Hash

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
funkdustvsgidsjoy.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
http://funkdustvsgidsjoy.com/bnzpersonal/bnz/home/index.htm
Connection
keep-alive
Cache-Control
no-cache
Referer
http://funkdustvsgidsjoy.com/bnzpersonal/bnz/home/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 01 Oct 2018 04:42:13 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=99
Content-Length
348
Content-Type
text/html; charset=iso-8859-1
SerranoWeb-Bold.woff2
www.bnz.co.nz/serrano/fonts/ 		21 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.bnz.co.nz/serrano/fonts/SerranoWeb-Bold.woff2?v=1c25c2c065
Requested by
Host: funkdustvsgidsjoy.com
URL: http://funkdustvsgidsjoy.com/bnzpersonal/bnz/home/index.htm
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
45.60.78.175 Redwood City, United States, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
Software
/
Resource Hash
00597164b7643a1a0040f59fe7167231ba550754b16f0c7df456d7490698ba11
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.bnz.co.nz/serrano/serrano.css
Origin
http://funkdustvsgidsjoy.com

Response headers

date
Mon, 01 Oct 2018 04:42:12 GMT
last-modified
Tue, 25 Sep 2018 22:08:20 GMT
x-cdn
Incapsula
status
200
etag
"5234"
strict-transport-security
max-age=31536000
content-type
application/font-woff2
access-control-allow-origin
*
x-iinfo
5-81133593-0 0CNN RT(1538368932746 0) q(0 -1 -1 0) r(0 -1)
cache-control
max-age=31189156, public
content-length
21044
expires
Fri, 27 Sep 2019 04:21:28 GMT
SerranoWeb-Regular.woff2
www.bnz.co.nz/serrano/fonts/ 		19 KB
19 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.bnz.co.nz/serrano/fonts/SerranoWeb-Regular.woff2?v=5b6826770c
Requested by
Host: funkdustvsgidsjoy.com
URL: http://funkdustvsgidsjoy.com/bnzpersonal/bnz/home/index.htm
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
45.60.78.175 Redwood City, United States, ASN19551 (INCAPSULA - Incapsula Inc, US),
Reverse DNS
Software
/
Resource Hash
9e63cdc77de3df5b0b0685849e03d263716a22ccf56e4ed74807504dc227221c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.bnz.co.nz/serrano/serrano.css
Origin
http://funkdustvsgidsjoy.com

Response headers

date
Mon, 01 Oct 2018 04:42:12 GMT
last-modified
Tue, 25 Sep 2018 22:08:20 GMT
x-cdn
Incapsula
status
200
etag
"4b2c"
strict-transport-security
max-age=31536000
content-type
application/font-woff2
access-control-allow-origin
*
x-iinfo
5-81133594-0 0CNN RT(1538368932747 0) q(0 -1 -1 2) r(0 -1)
cache-control
max-age=31189154, public
content-length
19244
expires
Fri, 27 Sep 2019 04:21:26 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BNZ Bank (Banking)

23 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| isUnsupportedBrowser object| OLA_DOMAINS function| L555 object| com_sas_ci_acs string| expires function| r0yy function| w0yy object| Hashcode object| GeneralBase64 object| Base64 object| spotMap object| dataTagToEventMap function| windowFocused function| windowBlured function| LocalQueue object| CryptoJS function| handleInjectResponse function| onYouTubeIframeAPIReady function| onYouTubePlayerReady function| extractValue function| loadDoc function| overridePrototypes function| getDecisionParams

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000