charge-ezy.stagingenv.co.nz Open in urlscan Pro
184.168.124.105 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://charge-ezy.stagingenv.co.nz/mobileapp/32.65.74.01.23.44/App.anz.nz/ANZOnlineCode3.html
Effective URL:
https://charge-ezy.stagingenv.co.nz/mobileapp/32.65.74.01.23.44/App.anz.nz/ANZOnlineCode3.html
Submission: On April 28 via api (April 28th 2023, 6:08:11 am UTC) from DE — Scanned from NZ

Summary HTTP 2 Redirects Links 6 Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 2 HTTP transactions. The main IP is 184.168.124.105, located in Singapore and belongs to AS-26496-GO-DADDY-COM-LLC, US. The main domain is charge-ezy.stagingenv.co.nz.
TLS certificate: Issued by cPanel, Inc. Certification Authority on April 1st 2023. Valid for: 3 months.

This is the only time charge-ezy.stagingenv.co.nz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: ANZ Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 2	184.168.124.105 184.168.124.105	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC)
1	45.60.160.117 45.60.160.117	19551 (INCAPSULA) (INCAPSULA)
2	2

2 184.168.124.105 (Singapore) 1 redirects

ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: 105.124.168.184.host.secureserver.net

charge-ezy.stagingenv.co.nz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 45.60.160.117 (United States)

ASN19551 (INCAPSULA, US)

digital.anz.co.nz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	stagingenv.co.nz 1 redirects charge-ezy.stagingenv.co.nz	12 KB
1	anz.co.nz digital.anz.co.nz	3 KB
2	2

	Domain	Requested by
2	charge-ezy.stagingenv.co.nz	1 redirects
1	digital.anz.co.nz	charge-ezy.stagingenv.co.nz
2	2

This site contains links to these domains. Also see Links.

Domain
www.anz.co.nz
digital.anz.co.nz

Subject Issuer	Validity	Valid
charge-ezy.stagingenv.co.nz cPanel, Inc. Certification Authority	`2023-04-01` - `2023-06-30`	3 months	crt.sh
digital.anz.co.nz DigiCert SHA2 Extended Validation Server CA	`2022-08-16` - `2023-09-16`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://charge-ezy.stagingenv.co.nz/mobileapp/32.65.74.01.23.44/App.anz.nz/ANZOnlineCode3.html
Frame ID: C4E3B3E7DE2D4D94DC071288023E45D2
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://charge-ezy.stagingenv.co.nz/mobileapp/32.65.74.01.23.44/App.anz.nz/ANZOnlineCode3.html HTTP 301
https://charge-ezy.stagingenv.co.nz/mobileapp/32.65.74.01.23.44/App.anz.nz/ANZOnlineCode3.html Page URL

Page Statistics

2
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

14 kB
Transfer

16 kB
Size

2
Cookies

6 Outgoing links

These are links going to different origins than the main page.

URL: http://www.anz.co.nz/
Title: ANZ Bank New Zealand Limited

Search URL Search Domain Scan URL

URL: http://www.anz.co.nz/auxiliary/help/help/website-security-privacy/
Title: Security & Privacy Statement

Search URL Search Domain Scan URL

URL: http://www.anz.co.nz/auxiliary/help/help/website-terms-use/
Title: Website Terms of Use

Search URL Search Domain Scan URL

URL: https://www.anz.co.nz/content/dam/anzconz/documents/common/ANZ-Electronic-Banking-Conditions.pdf
Title: Electronic Banking Conditions

Search URL Search Domain Scan URL

URL: http://www.anz.co.nz/auxiliary/contact-us/contact-us/
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://digital.anz.co.nz/preauth/web/service/login
Title: TOP

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://charge-ezy.stagingenv.co.nz/mobileapp/32.65.74.01.23.44/App.anz.nz/ANZOnlineCode3.html HTTP 301
https://charge-ezy.stagingenv.co.nz/mobileapp/32.65.74.01.23.44/App.anz.nz/ANZOnlineCode3.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request ANZOnlineCode3.html Show response
charge-ezy.stagingenv.co.nz/mobileapp/32.65.74.01.23.44/App.anz.nz/
Redirect Chain

http://charge-ezy.stagingenv.co.nz/mobileapp/32.65.74.01.23.44/App.anz.nz/ANZOnlineCode3.html
https://charge-ezy.stagingenv.co.nz/mobileapp/32.65.74.01.23.44/App.anz.nz/ANZOnlineCode3.html

11 KB
11 KB

712ms
240ms

Document
text/html

184.168.124.105
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: https://charge-ezy.stagingenv.co.nz/mobileapp/32.65.74.01.23.44/App.anz.nz/ANZOnlineCode3.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 184.168.124.105 , Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: 105.124.168.184.host.secureserver.net
Software: Apache /
Resource Hash: 0893add46d6b0e2ac22cf35ff9593b54f455c4e03cd696690291e8fc94fbd558

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: Keep-Alive
Content-Length: 11387
Content-Type: text/html
Date: Fri, 28 Apr 2023 06:08:06 GMT
Keep-Alive: timeout=5, max=100
Last-Modified: Wed, 10 Aug 2022 00:50:36 GMT
Server: Apache

Redirect headers

Connection: Keep-Alive
Content-Length: 302
Content-Type: text/html; charset=iso-8859-1
Date: Fri, 28 Apr 2023 06:08:06 GMT
Keep-Alive: timeout=5, max=100
Location: https://charge-ezy.stagingenv.co.nz/mobileapp/32.65.74.01.23.44/App.anz.nz/ANZOnlineCode3.html
Server: Apache

GET
H/1.1 200
OK anz_logo_gradient.svg
digital.anz.co.nz//preauth/assets/images/svg/brand/ 5 KB
3 KB 359ms
120ms Image
image/svg+xml 45.60.160.117
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://digital.anz.co.nz//preauth/assets/images/svg/brand/anz_logo_gradient.svg

Requested by

Host: charge-ezy.stagingenv.co.nz
URL: https://charge-ezy.stagingenv.co.nz/mobileapp/32.65.74.01.23.44/App.anz.nz/ANZOnlineCode3.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

45.60.160.117 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

c89404f1564e543aa95db072387fd1f3f84998b748be83af3e1df75910991925

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://charge-ezy.stagingenv.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Fri, 28 Apr 2023 06:08:06 GMT
Content-Encoding: gzip
Strict-Transport-Security: max-age=31536000
Last-Modified: Wed, 01 Mar 2023 22:10:26 GMT
X-CDN: Imperva
Etag: "8253ba66"
Content-Type: image/svg+xml
X-Iinfo: 2-1607190-0 0CNN RT(1682662086639 122) q(0 -1 -1 -1) r(0 -1)
Cache-Control: max-age=1558, public
Content-Length: 2108
Expires: Fri, 28 Apr 2023 06:34:04 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ANZ Bank (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.anz.co.nz/	1970-01-20 20:09:05	Name: visid_incap_2646974 Value: 3r/6VKJUT+WPlk3m2DjWl8ZiS2QAAAAAQUIPAAAAAAAMXAnUWiiQdQrLfERuuggP
			.anz.co.nz/	1969-12-31 23:59:59	Name: incap_ses_364_2646974 Value: kiieAy9QkA0f5oQf+zANBcZiS2QAAAAAdmcb4VwQqKMB3Oos5vTV8w==

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

charge-ezy.stagingenv.co.nz
digital.anz.co.nz
184.168.124.105
45.60.160.117
0893add46d6b0e2ac22cf35ff9593b54f455c4e03cd696690291e8fc94fbd558
c89404f1564e543aa95db072387fd1f3f84998b748be83af3e1df75910991925

charge-ezy.stagingenv.co.nz Open in urlscan Pro 184.168.124.105 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

2 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

14 kBTransfer

16 kBSize

2 Cookies

6 Outgoing links

Page URL History

Redirected requests

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

2 Cookies

Indicators

charge-ezy.stagingenv.co.nz Open in urlscan Pro
184.168.124.105 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

2
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

14 kB
Transfer

16 kB
Size

2
Cookies

2 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!