trading.anzshareinvesting.com.au
Open in
urlscan Pro
2a02:26f0:6c00:19c::34a3
Malicious Activity!
Public Scan
Effective URL: https://trading.anzshareinvesting.com.au/?status=2
Submission: On October 02 via manual from SG
Summary
TLS certificate: Issued by DigiCert Global CA G2 on August 13th 2018. Valid for: 2 years.
This is the only time trading.anzshareinvesting.com.au was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: ANZ Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 8 | 2a02:26f0:6c0... 2a02:26f0:6c00:19c::34a3 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 2 | 216.58.205.230 216.58.205.230 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
7 | 3 |
ASN20940 (AKAMAI-ASN1, US)
trading.anzshareinvesting.com.au |
ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s24-in-f230.1e100.net
4456902.fls.doubleclick.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
anzshareinvesting.com.au
2 redirects
trading.anzshareinvesting.com.au |
359 KB |
2 |
doubleclick.net
1 redirects
4456902.fls.doubleclick.net |
651 B |
7 | 2 |
Domain | Requested by | |
---|---|---|
8 | trading.anzshareinvesting.com.au |
2 redirects
trading.anzshareinvesting.com.au
|
2 | 4456902.fls.doubleclick.net |
1 redirects
trading.anzshareinvesting.com.au
|
7 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
webauthecc.anz.com |
www.anzshareinvesting.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
trading.anzshareinvesting.com.au DigiCert Global CA G2 |
2018-08-13 - 2020-08-12 |
2 years | crt.sh |
*.doubleclick.net GTS CA 1O1 |
2019-09-05 - 2019-11-28 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://trading.anzshareinvesting.com.au/?status=2
Frame ID: D1CFF355D1698E5AA758D9B42DCEE565
Requests: 8 HTTP requests in this frame
Frame:
https://4456902.fls.doubleclick.net/activityi;dc_pre=CLbTs7Db_uQCFY0Giwodso8GmQ;src=4456902;type=STBAc0;cat=stblo0;ord=1804046668551.44
Frame ID: DD990A88A6FECD622CB48B08AAD79D53
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://trading.anzshareinvesting.com.au/Manage/ProfitLoss
HTTP 302
https://trading.anzshareinvesting.com.au/logout.aspx?msg=2 HTTP 302
https://trading.anzshareinvesting.com.au/?status=2 Page URL
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title: Login
Search URL Search Domain Scan URL
Title: www.anzshareinvesting.com
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://trading.anzshareinvesting.com.au/Manage/ProfitLoss
HTTP 302
https://trading.anzshareinvesting.com.au/logout.aspx?msg=2 HTTP 302
https://trading.anzshareinvesting.com.au/?status=2 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 2- https://4456902.fls.doubleclick.net/activityi;src=4456902;type=STBAc0;cat=stblo0;ord=1804046668551.44 HTTP 302
- https://4456902.fls.doubleclick.net/activityi;dc_pre=CLbTs7Db_uQCFY0Giwodso8GmQ;src=4456902;type=STBAc0;cat=stblo0;ord=1804046668551.44
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
trading.anzshareinvesting.com.au/ Redirect Chain
|
11 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
external.less
trading.anzshareinvesting.com.au/cdn/47721226950a/anz/ |
248 KB 140 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sitelogon
trading.anzshareinvesting.com.au/cdn/js/builds/ |
110 KB 111 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
activityi;dc_pre=CLbTs7Db_uQCFY0Giwodso8GmQ;src=4456902;type=STBAc0;cat=stblo0;ord=1804046668551.44
4456902.fls.doubleclick.net/ Frame DD99 Redirect Chain
|
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo-anz.svg
trading.anzshareinvesting.com.au/App_Themes/ANZ/images/ |
38 KB 39 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
20 KB 20 KB |
Font
font/opentype |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fontawesome-webfont.woff2
trading.anzshareinvesting.com.au/client.shared/fonts/font-awesome/4.4.0/fonts/ |
63 KB 64 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
20 KB 20 KB |
Font
font/opentype |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
Endpoint
trading.anzshareinvesting.com.au/ClientRequest/ |
306 B 842 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: ANZ Bank (Banking)19 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| JsonStringifyCmc object| LZString object| cmcsb object| siteLogon function| DateParseISO8601 function| DateToISO8601 function| existingParseFunction number| webApiTrackingIdSeed function| WebApiBaseEndpoint object| webApiEndpoint function| $ function| jQuery function| htmlEncode object| jQuery171005746938380273825 string| axel number| a object| loginButton4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
trading.anzshareinvesting.com.au/ | Name: lb-sb-p Value: !WHEO4NGzFIkFKaA21OBOf8XJXwgjPgfRjwn3mLE5da3436PklovQ6TYqcFksbROabijI1oqL6zXv8Y2Mxwxx2a62s/0EEqA9uqJvI2U= |
|
.doubleclick.net/ | Name: IDE Value: AHWqTUlGTxh44zt51SsyBaFK6WOcxD4TcCfHht2NXT-vlKcS7-r06wgB3rll-EpZ |
|
trading.anzshareinvesting.com.au/ | Name: ASP.NET_SessionId Value: pig22qpygwojzrcv4dsu24kx |
|
trading.anzshareinvesting.com.au/ | Name: site Value: au4 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=15768000 |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
4456902.fls.doubleclick.net
trading.anzshareinvesting.com.au
216.58.205.230
2a02:26f0:6c00:19c::34a3
058fbcdc9d7b65a895391f5c30878e18f0d7f89943702a5b6d522c26c468406c
2ec6b0fa3a7ee1ab4a9ad22ab8f61b70a55f178f3b55ffd76da8abf81d96f288
3c4a1bb7ce3234407184f0d80cc4dec075e4ad616b44dcc5778e1cfb1bc24019
5842475418d2686dcf2a2fe75081a72d7796e2d9328ca9ac8d601f906c6bb83b
8d9ed79d872b319aba18744fcab46e56c3767cae9ba9a4ca0fafb205fe64663e
c04d4a52a7dcd4c6a6049391febdf8ee7dd58bac4a24c0ebdb1246e646473306
d97a7e4896f2ebe64cc1a0b90f2e50afe9c2dd1cb351ad8f7a0137eec04fb7bc
df477d03866885295a31b44c475bc6150273fc522c3bd5c1db69478650ebc2a5