client-anz-secure.org Open in urlscan Pro
95.85.73.90  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response client-anz-secure.org/	25 KB 5 KB	1230ms 211ms	Document text/html	95.85.73.90 GHOST
General Check archive.org Show headers Download Go to Full URL https://client-anz-secure.org/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.85.73.90 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS savingtochina002.example.com Software nginx / Resource Hash d4a6607a824613194821c9c9b0c31593aa1bdff82552a5757cda8f8b420a58cf Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers content-encoding gzip content-type text/html; charset=UTF-8 date Thu, 05 May 2022 11:22:26 GMT server nginx strict-transport-security max-age=31536000 vary Accept-Encoding
GET H2	200	site-jquery.min.js Show response client-anz-secure.org/admin/im/	91 KB 36 KB	216ms 215ms	Script application/javascript	95.85.73.90 GHOST
General Check archive.org Show headers Download Go to Full URL https://client-anz-secure.org/admin/im/site-jquery.min.js Requested by Host: client-anz-secure.org URL: https://client-anz-secure.org/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.85.73.90 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS savingtochina002.example.com Software nginx / Resource Hash 5994332aadd364a7350ad226ef61c1c75dc97372f739e01682e190be3abaf672 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://client-anz-secure.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Thu, 05 May 2022 11:22:26 GMT content-encoding gzip last-modified Mon, 23 Aug 2021 08:34:16 GMT server nginx etag W/"61235d88-16b60" vary Accept-Encoding content-type application/javascript cache-control max-age=43200 strict-transport-security max-age=31536000 expires Thu, 05 May 2022 23:22:26 GMT
GET H2	200	layui.js Show response client-anz-secure.org/admin/im/	284 KB 105 KB	425ms 425ms	Script application/javascript	95.85.73.90 GHOST
General Check archive.org Show headers Download Go to Full URL https://client-anz-secure.org/admin/im/layui.js Requested by Host: client-anz-secure.org URL: https://client-anz-secure.org/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.85.73.90 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS savingtochina002.example.com Software nginx / Resource Hash bbfe1536a99000acceb61f549aa59354cc596efc9f10d3843aab6b273f5adb1e Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://client-anz-secure.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Thu, 05 May 2022 11:22:26 GMT content-encoding gzip last-modified Tue, 06 Jul 2021 04:01:50 GMT server nginx etag W/"60e3d5ae-471da" vary Accept-Encoding content-type application/javascript cache-control max-age=43200 strict-transport-security max-age=31536000 expires Thu, 05 May 2022 23:22:26 GMT
GET H2	200	layer.min.css cdn.bootcdn.net/ajax/libs/layer/3.5.1/theme/default/	13 KB 3 KB	596ms 26ms	Stylesheet text/css	2606:4700:3038::6815:eac8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.bootcdn.net/ajax/libs/layer/3.5.1/theme/default/layer.min.css Requested by Host: client-anz-secure.org URL: https://client-anz-secure.org/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3038::6815:eac8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f99199228144a11b7adda7dad83f11c366ecb6f530ba8a352fb155bc0e58fc0e Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://client-anz-secure.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Thu, 05 May 2022 11:22:27 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 4257 x-cache HIT cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 timing-allow-origin * last-modified Fri, 11 Jun 2021 14:31:54 GMT server cloudflare cf-cdnjs-via cfworker/kv etag W/"60c373da-a5f" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mHc0Z1aHtN8M8%2BBX%2FlZDwLdkxuZz%2Fws6HdHH7kWxCZBm%2BPifieq8vXtpvb4YKPDbfrMX78GrK4mO%2BKFzevle5RbhtDY2Wopw%2FW8yj0mXEgM5GYuRqELjPaIUCgXli6FiCLCFLoqi"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control max-age=2678400 cf-ray 7069192ecfac9c07-FRA expires Thu, 05 May 2022 22:11:30 GMT
GET H2	200	anz-logo.1.0.0.svg login.anz.com/internetbanking//assets/img/	38 KB 28 KB	90ms 20ms	Image image/svg+xml	45.60.124.46 INCAPSULA
General Check archive.org Show headers Download Go to Show image Full URL https://login.anz.com/internetbanking//assets/img/anz-logo.1.0.0.svg Requested by Host: client-anz-secure.org URL: https://client-anz-secure.org/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.60.124.46 , United States, ASN19551 (INCAPSULA, US), Reverse DNS Software / Resource Hash df477d03866885295a31b44c475bc6150273fc522c3bd5c1db69478650ebc2a5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://client-anz-secure.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Thu, 05 May 2022 11:22:26 GMT content-encoding gzip last-modified Mon, 21 Mar 2022 02:07:24 GMT x-cdn Imperva etag W/"38862-1647828444000" strict-transport-security max-age=31536000; includeSubDomains content-type image/svg+xml x-iinfo 18-75844377-0 0CNN RT(1651749746742 38) q(0 -1 -1 2) r(0 -1) cache-control max-age=0 content-length 28683
GET H2	404	laydate.css client-anz-secure.org/admin/im/css/modules/laydate/default/	0 0	209ms 209ms	Stylesheet text/html	95.85.73.90 GHOST
General Check archive.org Show headers Download Go to Full URL https://client-anz-secure.org/admin/im/css/modules/laydate/default/laydate.css?v=5.3.1 Requested by Host: client-anz-secure.org URL: https://client-anz-secure.org/admin/im/layui.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.85.73.90 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS savingtochina002.example.com Software nginx / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://client-anz-secure.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Thu, 05 May 2022 11:22:27 GMT server nginx content-length 548 content-type text/html
GET H2	404	layer.css client-anz-secure.org/admin/im/css/modules/layer/default/	0 0	209ms 208ms	Stylesheet text/html	95.85.73.90 GHOST
General Check archive.org Show headers Download Go to Full URL https://client-anz-secure.org/admin/im/css/modules/layer/default/layer.css?v=3.5.1 Requested by Host: client-anz-secure.org URL: https://client-anz-secure.org/admin/im/layui.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.85.73.90 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS savingtochina002.example.com Software nginx / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://client-anz-secure.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Thu, 05 May 2022 11:22:27 GMT server nginx content-length 548 content-type text/html
GET H2	404	code.css client-anz-secure.org/admin/im/css/modules/	0 0	209ms 209ms	Stylesheet text/html	95.85.73.90 GHOST
General Check archive.org Show headers Download Go to Full URL https://client-anz-secure.org/admin/im/css/modules/code.css?v=2 Requested by Host: client-anz-secure.org URL: https://client-anz-secure.org/admin/im/layui.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.85.73.90 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS savingtochina002.example.com Software nginx / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://client-anz-secure.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Thu, 05 May 2022 11:22:27 GMT server nginx content-length 548 content-type text/html
GET H2	200	api.php Show response client-anz-secure.org/	13 B 309 B	214ms 214ms	XHR text/html	95.85.73.90 GHOST
General Check archive.org Show headers Download Go to Full URL https://client-anz-secure.org/api.php?act=ip_save&_r=0.26118059130707616 Requested by Host: client-anz-secure.org URL: https://client-anz-secure.org/admin/im/site-jquery.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.85.73.90 Central, Hong Kong, ASN202422 (GHOST, LU), Reverse DNS savingtochina002.example.com Software nginx / Resource Hash aa3d21398252adb9f16b5208884b4da22eec9f2019a0139b114a61f178396794 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Accept */* Referer https://client-anz-secure.org/ X-Requested-With XMLHttpRequest accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers pragma no-cache date Thu, 05 May 2022 11:22:27 GMT content-encoding gzip server nginx vary Accept-Encoding content-type text/html; charset=UTF-8 cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 strict-transport-security max-age=31536000 expires Thu, 19 Nov 1981 08:52:00 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ANZ Bank (Banking)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone function| getScreenDetails function| $ function| jQuery object| layui function| lay number| errors object| layer object| jQuery1101015361294179063756 object| mask object| timer object| hb_timer function| heart_beat function| ip_save function| is_agree function| checkSingleSubmit

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.anz.com/	1970-01-20 11:33:58	Name: visid_incap_2552332 Value: igvCamf5TuOsLrPojVRV0HKzc2IAAAAAQUIPAAAAAACJj3u/gVSKnwJYmPkszuqD
			.anz.com/	1969-12-31 23:59:59	Name: incap_ses_728_2552332 Value: vF59JlnOtVkcyM8+MGAaCnKzc2IAAAAAsPvrClmDiku7nyByC4U6iQ==
			client-anz-secure.org/	1969-12-31 23:59:59	Name: PHPSESSID Value: ja605slpurpamav4ckp00jd3e1

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://client-anz-secure.org/admin/im/css/modules/laydate/default/laydate.css?v=5.3.1 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://client-anz-secure.org/admin/im/css/modules/layer/default/layer.css?v=3.5.1 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://client-anz-secure.org/admin/im/css/modules/code.css?v=2 Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.bootcdn.net
client-anz-secure.org
login.anz.com
2606:4700:3038::6815:eac8
45.60.124.46
95.85.73.90
5994332aadd364a7350ad226ef61c1c75dc97372f739e01682e190be3abaf672
aa3d21398252adb9f16b5208884b4da22eec9f2019a0139b114a61f178396794
bbfe1536a99000acceb61f549aa59354cc596efc9f10d3843aab6b273f5adb1e
d4a6607a824613194821c9c9b0c31593aa1bdff82552a5757cda8f8b420a58cf
df477d03866885295a31b44c475bc6150273fc522c3bd5c1db69478650ebc2a5
f99199228144a11b7adda7dad83f11c366ecb6f530ba8a352fb155bc0e58fc0e