www.westpac.direct
Open in
urlscan Pro
35.244.80.173
Malicious Activity!
Public Scan
Submission: On May 27 via manual from FI
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on May 26th 2019. Valid for: 3 months.
This is the only time www.westpac.direct was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Westpac (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
7 | 35.244.80.173 35.244.80.173 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
3 | 52.72.79.100 52.72.79.100 | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
1 | 2a00:1450:400... 2a00:1450:4001:821::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 203.24.3.4 203.24.3.4 | 9426 (WESTPAC-A...) (WESTPAC-AS-AP Westpac Bank) | |
12 | 4 |
ASN15169 (GOOGLE - Google LLC, US)
PTR: 173.80.244.35.bc.googleusercontent.com
www.westpac.direct |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-72-79-100.compute-1.amazonaws.com
upcode.editor.multiscreensite.com |
ASN15169 (GOOGLE - Google LLC, US)
ajax.googleapis.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
westpac.direct
www.westpac.direct |
349 KB |
3 |
multiscreensite.com
upcode.editor.multiscreensite.com |
58 KB |
1 |
westpac.com.au
banking.westpac.com.au |
4 KB |
1 |
googleapis.com
ajax.googleapis.com |
29 KB |
12 | 4 |
Domain | Requested by | |
---|---|---|
7 | www.westpac.direct |
www.westpac.direct
upcode.editor.multiscreensite.com |
3 | upcode.editor.multiscreensite.com |
www.westpac.direct
|
1 | banking.westpac.com.au |
www.westpac.direct
|
1 | ajax.googleapis.com |
www.westpac.direct
|
12 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.westpac.com.au |
Subject Issuer | Validity | Valid | |
---|---|---|---|
westpac.direct Let's Encrypt Authority X3 |
2019-05-26 - 2019-08-24 |
3 months | crt.sh |
multiscreensite.com Let's Encrypt Authority X3 |
2019-04-07 - 2019-07-06 |
3 months | crt.sh |
*.googleapis.com Google Internet Authority G3 |
2019-05-07 - 2019-07-30 |
3 months | crt.sh |
banking.westpac.com.au Entrust Certification Authority - L1M |
2018-04-06 - 2020-04-06 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.westpac.direct/
Frame ID: 3D224D9504715654659AA0AA9AED2505
Requests: 12 HTTP requests in this frame
Screenshot
Detected technologies
Nginx (Web Servers) ExpandDetected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Modernizr (JavaScript Libraries) Expand
Detected patterns
- env /^Modernizr$/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Forgot customer ID or password?
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
www.westpac.direct/ |
25 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
nee-css-font-package.min.css
upcode.editor.multiscreensite.com/mb/_dm/s/rt/dist/css/ |
162 KB 27 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
d-css-runtime-mobile-package.min.css
upcode.editor.multiscreensite.com/mb/_dm/s/rt/dist/css/ |
126 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
test.css
www.westpac.direct/westpac/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
westpac.css
www.westpac.direct/westpac/ |
210 KB 211 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.1.1/ |
82 KB 29 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wp_preview.js
upcode.editor.multiscreensite.com/mb/editor/scripts/ |
27 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
goback.png
www.westpac.direct/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo_200.png.a63c92bece6e2a0644b657cc3054f7b63f870b58.png
banking.westpac.com.au/wbc/banking/Themes/Default/Desktop/WBC/Core/Images/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
form.css
www.westpac.direct/westpac/ |
128 KB 129 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
form.css
www.westpac.direct/.westpac/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
util.js
www.westpac.direct/mb/editor/scripts/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Westpac (Banking)85 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask boolean| isWLR function| buildEditorParent boolean| isMultiScreen object| editorParent object| previewParent string| assetsCacheQueryParam object| customWidgetsFunctions function| $ function| jQuery boolean| previewPopUp string| rconfWar function| showLoadingDots function| showLoadingDotsNEW function| hideLoading function| getElementProperty function| getStyleProp function| replaceAll function| setTempCss function| isIE function| wpGetStyleSheet function| wpGetThemeStyleSheet function| wpGetHeaderPageStyleSheet function| wpGetHeaderPageDeviceStyleSheet function| wpGetPageStyleSheet function| wpGetPageDeviceStyleSheet function| _dmGetStyleSheet function| _getSpecificSheetNode function| cleanInlineStyle function| updateInlineStyle function| getInlineStyleAttribute function| getGlobalCSSToString function| getGlobalThemeCSSToString function| getPageCSSToString function| getPageDeviceCSSToString function| getHeaderPageCSSToString function| _dmCSSToString function| updateCssInternal function| updateCss function| prioritizeCss function| removeCssAttributesFromStyleSheet function| removeCssAttributes function| updateCssIEInternal function| updateCssIE function| removeCssAttributesIEInternal function| removeCssAttributesIE function| refreshGlobalCss function| refreshGlobalAndThemeCssInternal function| refreshGlobalCssInternal function| refreshGeneratedCss function| refreshGlobalCssInternalIE function| refreshPageStyleCss function| refreshPageStyleDeviceCss function| refreshGlobalCssAndShowLoading function| refreshGlobalCssAndShowLoadingNEW function| initComponents function| removeOldCss function| removeStyleAndReplace function| removeOldPageStyle function| removeOldDevicePageStyle function| updateLogoImage function| getLogoImageUrl function| getLogoImage function| getElementByID function| getHeader function| isThemeLogoImageHidden function| resetLogOImage function| setDMAjaxMoreNavigationParameter function| setDMAjaxNavSize function| setDMAjaxLessNavigationParameter function| setDMAjaxBackToHomeParameter function| getDMAjaxBackToHomeParameter function| isBackToHomeTextVisible function| isSiteHasMoreLessButtons function| loadStoreScript object| documentStyles function| _findCurrentNavText function| _findCurrentNavId function| styleImages object| Modernizr number| expireDays number| visitLength function| setSmartSiteCookies0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
banking.westpac.com.au
upcode.editor.multiscreensite.com
www.westpac.direct
203.24.3.4
2a00:1450:4001:821::200a
35.244.80.173
52.72.79.100
249f0795d166b83ba865d3358b6482b5617108e3b226547f4019de9a6bdc8a8d
3c463308d16b44b307ebbe530776a8884667e0dc5e683b5cd2ed9cd515035dfe
5425a459135db245e54b2ec02314683536862bf3294750c0eef99f3c3b210bfb
874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4
a990e2a0495895bbea44ba9b5fb6379664c59b147504da8384ad6019e9e857dd
b92bb8c6ff8baf8a3af45586da1863a0d280eb21c46f6b418f196bf368233290
c35ebaef57a8115d86bcd0f9a1522796fda3c103358a13e9665d2cbe53ee019a
cfaced42b102891e6ecb06ee984096542656b303f02b38becc9e5038ef0b750a
f203c716be7f29304171aaa7ec8e333d7d70b53fa2ffa217e563c28035862002