wgconstructors.com
Open in
urlscan Pro
23.235.214.102
Malicious Activity!
Public Scan
Submitted URL: https://www.wgconstructors.com/asb-customer-tax-residency/EPPORUFJVSUGGS7DW4HEGW654RJHBFD09SDJHF/auth
Effective URL: https://wgconstructors.com/asb-customer-tax-residency/EPPORUFJVSUGGS7DW4HEGW654RJHBFD09SDJHF/auth/login
Submission Tags: 6736863
Submission: On August 19 via api from US
Effective URL: https://wgconstructors.com/asb-customer-tax-residency/EPPORUFJVSUGGS7DW4HEGW654RJHBFD09SDJHF/auth/login
Submission Tags: 6736863
Submission: On August 19 via api from US
Summary
This website contacted 3 IPs
in 2 countries
across 3 domains to perform 27 HTTP transactions.
The main IP is 23.235.214.102, located in
El Segundo, United States and
belongs to IMH-WEST, US.
The main domain is wgconstructors.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on July 5th 2020. Valid for: 3 months.
This is the only time wgconstructors.com was scanned on urlscan.io!
TLS certificate: Issued by Let's Encrypt Authority X3 on July 5th 2020. Valid for: 3 months.
This is the only time wgconstructors.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: ASB Bank (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 18 | 23.235.214.102 23.235.214.102 | 22611 (IMH-WEST) (IMH-WEST) | |
| 1 | 2a00:1450:400... 2a00:1450:4001:818::2003 | 15169 (GOOGLE) (GOOGLE) | |
| 27 | 3 |
18
23.235.214.102
(El Segundo, United States)
ASN22611 (IMH-WEST, US)
PTR: ded2394.inmotionhosting.com
ASN22611 (IMH-WEST, US)
PTR: ded2394.inmotionhosting.com
| www.wgconstructors.com | |
| wgconstructors.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 18 |
wgconstructors.com
1 redirects
www.wgconstructors.com wgconstructors.com |
201 KB |
| 1 |
gstatic.com
www.gstatic.com |
130 KB |
| 0 |
asb.co.nz
Failed
online.asb.co.nz Failed |
|
| 27 | 3 |
| Domain | Requested by | |
|---|---|---|
| 17 | wgconstructors.com |
wgconstructors.com
|
| 1 | www.gstatic.com |
wgconstructors.com
|
| 1 | www.wgconstructors.com | 1 redirects |
| 0 | online.asb.co.nz Failed |
wgconstructors.com
|
| 27 | 4 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| online.asb.co.nz |
| www.asb.co.nz |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| wgconstructors.com Let's Encrypt Authority X3 |
2020-07-05 - 2020-10-03 |
3 months | crt.sh |
| *.gstatic.com GTS CA 1O1 |
2020-07-15 - 2020-10-07 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://wgconstructors.com/asb-customer-tax-residency/EPPORUFJVSUGGS7DW4HEGW654RJHBFD09SDJHF/auth/login
Frame ID: 54A34B7378D448496F7222BE3FF65C9E
Requests: 27 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://www.wgconstructors.com/asb-customer-tax-residency/EPPORUFJVSUGGS7DW4HEGW654RJHBFD09SDJHF/auth
HTTP 302
https://wgconstructors.com/asb-customer-tax-residency/EPPORUFJVSUGGS7DW4HEGW654RJHBFD09SDJHF/auth/login Page URL
Detected technologies
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Modernizr
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /([\d.]+)?\/modernizr(?:.([\d.]+))?.*\.js/i
Underscore.js
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /underscore.*\.js(?:\?ver=([\d.]+))?/i
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /jquery[.-]([\d.]*\d)[^/]*\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
6 Outgoing links
These are links going to different origins than the main page.
URL: https://online.asb.co.nz/auth/login?action=forgotpwd
Title: Forgot your password?
Title: Forgot your password?
Search URL Search Domain Scan URL
URL: https://www.asb.co.nz/bank-accounts/joining-asb.html
Title: Register now
Title: Register now
Search URL Search Domain Scan URL
URL: https://www.asb.co.nz/documents/banking-with-asb/fastnet-classic-terms-and-conditions.html
Title: Terms and conditions
Title: Terms and conditions
Search URL Search Domain Scan URL
URL: https://www.asb.co.nz/security
Title: About security
Title: About security
Search URL Search Domain Scan URL
URL: https://www.asb.co.nz/privacy
Title: Privacy
Title: Privacy
Search URL Search Domain Scan URL
URL: https://www.asb.co.nz/documents/banking-with-asb/internet-access-terms-and-conditions.html
Title: Internet access terms
Title: Internet access terms
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://www.wgconstructors.com/asb-customer-tax-residency/EPPORUFJVSUGGS7DW4HEGW654RJHBFD09SDJHF/auth
HTTP 302
https://wgconstructors.com/asb-customer-tax-residency/EPPORUFJVSUGGS7DW4HEGW654RJHBFD09SDJHF/auth/login Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
27 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
login
wgconstructors.com/asb-customer-tax-residency/EPPORUFJVSUGGS7DW4HEGW654RJHBFD09SDJHF/auth/ Redirect Chain
|
21 KB 21 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
fonts.css
wgconstructors.com/asb-customer-tax-residency/EPPORUFJVSUGGS7DW4HEGW654RJHBFD09SDJHF/css/ |
4 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
style.css
wgconstructors.com/asb-customer-tax-residency/EPPORUFJVSUGGS7DW4HEGW654RJHBFD09SDJHF/css/ |
21 KB 22 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
modernizr-2.js
wgconstructors.com/asb-customer-tax-residency/EPPORUFJVSUGGS7DW4HEGW654RJHBFD09SDJHF/js/ |
17 KB 17 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
json2.js
wgconstructors.com/asb-customer-tax-residency/EPPORUFJVSUGGS7DW4HEGW654RJHBFD09SDJHF/js/ |
3 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
sha1.js
wgconstructors.com/asb-customer-tax-residency/EPPORUFJVSUGGS7DW4HEGW654RJHBFD09SDJHF/js/ |
5 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-1.js
wgconstructors.com/asb-customer-tax-residency/EPPORUFJVSUGGS7DW4HEGW654RJHBFD09SDJHF/js/ |
94 KB 95 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
PopupManager.js
wgconstructors.com/asb-customer-tax-residency/EPPORUFJVSUGGS7DW4HEGW654RJHBFD09SDJHF/js/ |
4 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
custFontSize.js
wgconstructors.com/asb-customer-tax-residency/EPPORUFJVSUGGS7DW4HEGW654RJHBFD09SDJHF/js/ |
852 B 882 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
underscore-min.js
wgconstructors.com/asb-customer-tax-residency/EPPORUFJVSUGGS7DW4HEGW654RJHBFD09SDJHF/js/ |
16 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
api.js
wgconstructors.com/asb-customer-tax-residency/EPPORUFJVSUGGS7DW4HEGW654RJHBFD09SDJHF/js/ |
733 B 786 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
loginBody.js
wgconstructors.com/asb-customer-tax-residency/EPPORUFJVSUGGS7DW4HEGW654RJHBFD09SDJHF/js/ |
2 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
func.js
wgconstructors.com/asb-customer-tax-residency/EPPORUFJVSUGGS7DW4HEGW654RJHBFD09SDJHF/js/ |
5 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
overpass-regular.woff2
online.asb.co.nz/auth/css/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
icon-asb.svg
wgconstructors.com/asb-customer-tax-residency/EPPORUFJVSUGGS7DW4HEGW654RJHBFD09SDJHF/img/ |
1 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
icon-profile.svg
wgconstructors.com/asb-customer-tax-residency/EPPORUFJVSUGGS7DW4HEGW654RJHBFD09SDJHF/img/ |
534 B 587 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
icon-lock-outline.svg
wgconstructors.com/asb-customer-tax-residency/EPPORUFJVSUGGS7DW4HEGW654RJHBFD09SDJHF/img/ |
757 B 810 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
icon-information.svg
wgconstructors.com/asb-customer-tax-residency/EPPORUFJVSUGGS7DW4HEGW654RJHBFD09SDJHF/img/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
overpass-semibold.woff2
online.asb.co.nz/auth/css/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
overpass-extralight.woff2
online.asb.co.nz/auth/css/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
recaptcha__en.js
www.gstatic.com/recaptcha/releases/IU7gZ7o6RDdDE6U4Y1YJJWnN/ |
332 KB 130 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
overpass-regular.woff
online.asb.co.nz/auth/css/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
overpass-semibold.woff
online.asb.co.nz/auth/css/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
overpass-extralight.woff
online.asb.co.nz/auth/css/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
overpass-regular.ttf
online.asb.co.nz/auth/css/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
overpass-semibold.ttf
online.asb.co.nz/auth/css/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
overpass-extralight.ttf
online.asb.co.nz/auth/css/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- online.asb.co.nz
- URL
- https://online.asb.co.nz/auth/css/fonts/overpass-regular.woff2
- Domain
- online.asb.co.nz
- URL
- https://online.asb.co.nz/auth/css/fonts/overpass-semibold.woff2
- Domain
- online.asb.co.nz
- URL
- https://online.asb.co.nz/auth/css/fonts/overpass-extralight.woff2
- Domain
- online.asb.co.nz
- URL
- https://online.asb.co.nz/auth/css/fonts/overpass-regular.woff
- Domain
- online.asb.co.nz
- URL
- https://online.asb.co.nz/auth/css/fonts/overpass-semibold.woff
- Domain
- online.asb.co.nz
- URL
- https://online.asb.co.nz/auth/css/fonts/overpass-extralight.woff
- Domain
- online.asb.co.nz
- URL
- https://online.asb.co.nz/auth/css/fonts/overpass-regular.ttf
- Domain
- online.asb.co.nz
- URL
- https://online.asb.co.nz/auth/css/fonts/overpass-semibold.ttf
- Domain
- online.asb.co.nz
- URL
- https://online.asb.co.nz/auth/css/fonts/overpass-extralight.ttf
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: ASB Bank (Banking)48 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| trustedTypes object| Modernizr object| html5 function| yepnope function| hex_sha1 function| b64_sha1 function| any_sha1 function| hex_hmac_sha1 function| b64_hmac_sha1 function| any_hmac_sha1 function| sha1_vm_test function| rstr_sha1 function| rstr_hmac_sha1 function| rstr2hex function| rstr2b64 function| rstr2any function| str2rstr_utf8 function| str2rstr_utf16le function| str2rstr_utf16be function| rstr2binb function| binb2rstr function| binb_sha1 function| sha1_ft function| sha1_kt function| safe_add function| bit_rol number| hexcase string| b64pad function| $ function| jQuery function| popupManagerRegisterNS object| ASB function| custFontSize function| _ function| onSubmit object| antiClickjack object| loginConfig function| getCookie string| warningString function| LoadFunc object| jQuery1110009242906656979089 number| intFontSize number| currentFontSize number| c_start object| ___grecaptcha_cfg object| grecaptcha boolean| __google_recaptcha_client object| recaptcha0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
online.asb.co.nz
wgconstructors.com
www.gstatic.com
www.wgconstructors.com
online.asb.co.nz
23.235.214.102
2a00:1450:4001:818::2003
0e640eef6b64e02e5c4ed8c1dbcfc8b275e177051dda0e979606e69f42297359
10b33fdad14719c081f524e492199133dab898e40a5da5a393df1a3b9a3d0633
1274f09ff41e34718771c90edda5b41b011e4122006fbfb9bb6efa7adb392cce
2459106feecaf804a1c3e02d0e7968e52c4036ed71b6455cae155a5730846ccc
3697c2d6dce22c53f2929a3a06a7b8d9c45fb3b3004d66a40e3ae5d523c769e0
3db54f048976bba9be511193a71b32a4f824782860292ebc909c36333b3e2033
3f20f7b5c6a167c81a08fd9f810c149dd791d9dcd8c5565f7e55a20140c70d94
746e54e89161118a67bd59103c4ab55e3060735cc85c1d047c2cf04d4b12043d
7e9524154c00820e477b9289c2a86727673c17edb1bf531b41771cc5d6245d5a
8ed769e9c3db90a36cfc03e8cae73eedf2a554b464d689b7b246442302ffe41e
951349bd5206d7885ec9d7e299f2115618eeefdd9f9c53fdb834187aee291f03
a1ed2d84ee7a8d8675059aa8f2ec2f4252b3cb128cbaf33542fc6842651f4b20
ae53b8317e54a9e60cded2b876fa42538391c5d782b908995d5d54940f534ce5
b439b97d3e6d44cc7b7aa0c1716833a721ff258911a2dd455d84da9ecf5e079b
b49b397871dff384aab300554a8f1745d86e020edd55dea9f1ad58209a1b7563
bce31cd5fcf9edb3c13f68c8270e8dd6181b0dcb12143342a0e55bcf805fc92d
daff09c2eed6877d426f90bff5e7997c1f2d8123a0a3637fa5a7b1e2ac71f305
ea96c489669f0f8f60e99fa09e947d4ba62cbde2a11b905318c5d94cfbdaceef