ulvilasilta.top
Open in
urlscan Pro
2606:4700:30::681f:49a6
Malicious Activity!
Public Scan
Submission: On October 30 via manual from NZ
Summary
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on October 30th 2019. Valid for: a year.
This is the only time ulvilasilta.top was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Westpac (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
34 | 2606:4700:30:... 2606:4700:30::681f:49a6 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
34 | 1 |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
ulvilasilta.top |
Apex Domain Subdomains |
Transfer | |
---|---|---|
34 |
ulvilasilta.top
ulvilasilta.top |
385 KB |
34 | 1 |
Domain | Requested by | |
---|---|---|
34 | ulvilasilta.top |
ulvilasilta.top
|
34 | 1 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.westpac.co.nz |
www.entrust.net |
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com CloudFlare Inc ECC CA-2 |
2019-10-30 - 2020-10-09 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://ulvilasilta.top/WESTPAC/wstpc/login.php
Frame ID: 877A62E018C7D90997EB88391761D182
Requests: 33 HTTP requests in this frame
Frame:
https://ulvilasilta.top/WESTPAC/wstpc/login_files/dest5.html
Frame ID: 186598A0A97E312B1FC255DECB089BE1
Requests: 1 HTTP requests in this frame
Screenshot
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- url /\.php(?:$|\?)/i
CloudFlare (CDN) Expand
Detected patterns
- headers server /^cloudflare$/i
Dynatrace (Analytics) Expand
Detected patterns
- script /dtagent.*\.js/i
SiteCatalyst (Analytics) Expand
Detected patterns
- script /\/s[_-]code.*\.js/i
Page Statistics
3 Outgoing links
These are links going to different origins than the main page.
Title: Westpac online guardian
Search URL Search Domain Scan URL
Title: Westpac online guarantee
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
34 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
login.php
ulvilasilta.top/WESTPAC/wstpc/ |
13 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
s36129399378666
ulvilasilta.top/WESTPAC/wstpc/login_files/ |
365 B 422 B |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dtagent_ICA_7000000081014.js
ulvilasilta.top/WESTPAC/wstpc/login_files/ |
50 KB 20 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-ui-1.10.3.custom.css
ulvilasilta.top/WESTPAC/wstpc/login_files/ |
66 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vendor.css
ulvilasilta.top/WESTPAC/wstpc/login_files/ |
0 114 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles.css
ulvilasilta.top/WESTPAC/wstpc/login_files/ |
159 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
entrance.css
ulvilasilta.top/WESTPAC/wstpc/login_files/ |
319 KB 41 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.css
ulvilasilta.top/WESTPAC/wstpc/login_files/ |
641 KB 75 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sjcl.js
ulvilasilta.top/WESTPAC/wstpc/login_files/ |
23 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sha.js
ulvilasilta.top/WESTPAC/wstpc/login_files/ |
17 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
satellite-5c0d71ac64746d19e600f896.js
ulvilasilta.top/WESTPAC/wstpc/login_files/ |
259 B 222 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
s-code-contents-addd2f3ce0de416269fe730535978be0672e0d06.js
ulvilasilta.top/WESTPAC/wstpc/login_files/ |
76 KB 26 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo-westpac-w.svg
ulvilasilta.top/WESTPAC/wstpc/login_files/ |
842 B 548 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo-westpac-one-white.svg
ulvilasilta.top/WESTPAC/wstpc/login_files/ |
2 KB 1009 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
phone-rotate.gif
ulvilasilta.top/WESTPAC/wstpc/login_files/ |
18 KB 18 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
phone-rotate@2.gif
ulvilasilta.top/WESTPAC/wstpc/login_files/ |
40 KB 40 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ibmmfpf.js
ulvilasilta.top/WESTPAC/wstpc/login_files/ |
305 KB 59 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
print.css
ulvilasilta.top/WESTPAC/wstpc/login_files/ |
9 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
background-westpac-one.png
ulvilasilta.top/WESTPAC/wstpc/images/ |
26 KB 26 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
user.svg
ulvilasilta.top/WESTPAC/wstpc/images/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
password.svg
ulvilasilta.top/WESTPAC/wstpc/images/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
online-guardian-6.9.png
ulvilasilta.top/WESTPAC/wstpc/images/ |
11 KB 11 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
banking-guarantee-6.9.png
ulvilasilta.top/WESTPAC/wstpc/images/ |
10 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
entrust.png
ulvilasilta.top/WESTPAC/wstpc/images/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
MyriadPro-Bold.woff
ulvilasilta.top/WESTPAC/wstpc/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
MyriadPro-Regular.woff
ulvilasilta.top/WESTPAC/wstpc/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
MyriadPro-Semibold.woff
ulvilasilta.top/WESTPAC/wstpc/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sjcl.js
ulvilasilta.top/WESTPAC/wstpc/login_files/login_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sha.js
ulvilasilta.top/WESTPAC/wstpc/login_files/login_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dest5.html
ulvilasilta.top/WESTPAC/wstpc/login_files/ Frame 1865 |
7 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
MyriadPro-Regular.ttf
ulvilasilta.top/WESTPAC/wstpc/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
MyriadPro-Semibold.ttf
ulvilasilta.top/WESTPAC/wstpc/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
MyriadPro-Bold.ttf
ulvilasilta.top/WESTPAC/wstpc/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
dynaTraceMonitor
ulvilasilta.top/WESTPAC/wstpc/ |
315 B 446 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Westpac (Banking)57 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate object| a object| dT_ object| dynaTrace function| q object| s boolean| u object| sjcl function| w function| x function| C function| E function| A function| B function| D undefined| F undefined| G object| H boolean| I undefined| J undefined| K function| jsSHA function| s_doPlugins function| AppMeasurement_Module_AudienceManagement function| AppMeasurement_Module_ActivityMap function| AppMeasurement function| s_gi function| s_pgicq object| s_c_il number| s_c_in function| DIL number| s_objectID number| s_giq object| logger object| ibmmfpfanalytics function| Deferred function| WLJQ object| WLJSX function| __WLConfig function| __WLLocalStorageDB function| __WLClient function| __WLBrowserManager function| __WLApp function| __WLDeviceAuth function| __WLLocalStorage function| __WLDevice boolean| isCryptoShim function| __WLCrypto function| __WLIndexDB function| __WLDAO function| __WLAsyncDAO function| __WLSyncDAOWrapper function| __WLVarStorageDB function| WLResourceRequest object| WLAuthorizationManager object| WL1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
ulvilasilta.top/ | Name: dtPC Value: 469074296_747h2 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ulvilasilta.top
2606:4700:30::681f:49a6
05d808701b9126207f5675b186b4d43bf5ee97c4e529f0c0c9a7d2cc864a0de8
068c4f76428b99e77b9267710e97e1433e404c1a651a2c164ae6e84631c32f4b
1a710e0436da3045a84a0339a4cc68607c671edd4e095a227a98ca463801061b
23e22334f525b2759e87148b6f29191ac1ebb8d411456a70496e6734f5a5c7dc
252d6031409638366a6b9b2974224fe13c1c75c027330030581913511dd9441e
3d653cbd8561f683dba6e8cc809359354208bd67a88abaa32b76fc9ed4e669f8
440ce5d34159080809d260e9631ccadd36214597cec0dfddf23ba35b7055ce24
55de14b6e7a209964e275b08da5fcc131b058fb04bb781bcaf3386b0e81811ce
5e488f170b828966f0522de04aded0627dadd03efa8f7de63c355bebbfdec926
70848a647d6d22de147a828b5db04c2f60f5fd9bae9b5897d1edc62003a4603d
7d57035f2f546e019581e9022898f64baaecf68941325cbb6d31b6644647258f
863e69af875a8080cabbe30e51e6e3f08c78e4eb71ebc9aee0231567ad64ae97
94590969b4a01e2ce7813a6d8de0175a66218c836f2bf5fbe7691a3056ade21d
a14200871ebe84b70c90160456bae81eb2a5dcbb4fc74a77d46370e0ccb4bb11
c03072b0a2d5c1c0d60120b13eb3470e95d055b82a89b57ca41bdfd76b572282
c4e3f8537ec1bdde74efcf55a65e5f08216f552a34e3d6668936d910158f265c
cd2b2caf88f91cde74e2d96cb52f8259232b53b0d0986a2cda7b44c268a34179
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
d5cc95ffbc5998fd8e83313269dd5dfda8bc4c7f06cd737c3179dbe599ba6d87
d5e412541ca37133224786f7bb5f03a7658fa3d79fd11b0967e6cfdb9dbab75e
dabba46db5b26137e324f057fcdacca92fac84025f2243445a4488e6d6ead15a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ed1e8f674a5630102ec1cfafc438f3f88675ac57f576dd0cd26595f5fc07d01f
fb3a6e43bc13dd8ba3d4cb557202ace068d523d832d6a0312efa3282ede43df8