pub-8b7b3acc9111415d915db93c86c75e53.r2.dev Open in urlscan Pro
2606:4700::6812:323 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://pub-8b7b3acc9111415d915db93c86c75e53.r2.dev/5.html
Effective URL:
https://pub-8b7b3acc9111415d915db93c86c75e53.r2.dev/5.html
Submission: On May 16 via api (May 16th 2024, 6:05:19 pm UTC) from FR — Scanned from FR

Summary HTTP 3 Redirects Links 12 Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 3 HTTP transactions. The main IP is 2606:4700::6812:323, located in United States and belongs to CLOUDFLARENET, US. The main domain is pub-8b7b3acc9111415d915db93c86c75e53.r2.dev.
TLS certificate: Issued by E1 on April 5th 2024. Valid for: 3 months.

This is the only time pub-8b7b3acc9111415d915db93c86c75e53.r2.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: ANZ Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	2606:4700::68... 2606:4700::6812:323	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:808::200a	15169 (GOOGLE) (GOOGLE)
1	172.67.74.152 172.67.74.152	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	4

1 2606:4700::6812:323 (United States)

ASN13335 (CLOUDFLARENET, US)

pub-8b7b3acc9111415d915db93c86c75e53.r2.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.74.152 (United States)

ASN13335 (CLOUDFLARENET, US)

api.ipify.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	ipify.org api.ipify.org — Cisco Umbrella Rank: 2924	154 B
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 380	30 KB
1	r2.dev pub-8b7b3acc9111415d915db93c86c75e53.r2.dev	562 KB
3	3

	Domain	Requested by
1	api.ipify.org	ajax.googleapis.com
1	ajax.googleapis.com	pub-8b7b3acc9111415d915db93c86c75e53.r2.dev
1	pub-8b7b3acc9111415d915db93c86c75e53.r2.dev
3	3

This site contains links to these domains. Also see Links.

Domain
www.recovery.anz.com
login.anz.com
register.anz.com
www.anz.com.au

Subject Issuer	Validity	Valid
*.r2.dev E1	`2024-04-05` - `2024-07-04`	3 months	crt.sh
upload.video.google.com WR2	`2024-05-06` - `2024-07-29`	3 months	crt.sh
ipify.org GTS CA 1P5	`2024-03-21` - `2024-06-19`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://pub-8b7b3acc9111415d915db93c86c75e53.r2.dev/5.html
Frame ID: 78555232988FDA37A6A5B29059473008
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login - ANZ Internet Banking

Page URL History Show full URLs

http://pub-8b7b3acc9111415d915db93c86c75e53.r2.dev/5.html HTTP 307
https://pub-8b7b3acc9111415d915db93c86c75e53.r2.dev/5.html Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

3
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

746 kB
Transfer

1007 kB
Size

0
Cookies

12 Outgoing links

These are links going to different origins than the main page.

URL: https://www.recovery.anz.com/recover/do-you-know-your-crn?target=host1&ctiId={7b21b8d7-f519-4d7c-ae71-31b602d386f1}&mboxid=PC%2333be87796af745aba45a37283be836f8.32_0%231778190493%7Csession%23d8fc4378fdf64a3e8b8007d970b9c3aa%231714947553&adobe_mc=MCMID%3D29085826287016981395942979357405473398%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1714945692
Title: Forgot login details?

Search URL Search Domain Scan URL

URL: https://login.anz.com/internetbanking/help
Title: Help

Search URL Search Domain Scan URL

URL: https://register.anz.com/internetbanking?mboxid=PC%2333be87796af745aba45a37283be836f8.32_0%231778190493%7Csession%23d8fc4378fdf64a3e8b8007d970b9c3aa%231714947553&adobe_mc=MCMID%3D29085826287016981395942979357405473398%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1714945692
Title: Register

Search URL Search Domain Scan URL

URL: https://www.anz.com.au/privacy/centre/?mboxid=PC%2333be87796af745aba45a37283be836f8.32_0%231778190493%7Csession%23d8fc4378fdf64a3e8b8007d970b9c3aa%231714947553&adobe_mc=MCMID%3D29085826287016981395942979357405473398%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1714945692
Title: Security and Privacy Statement.

Search URL Search Domain Scan URL

URL: https://www.anz.com.au/security/?pid=glo-ibl-t-ib-04-24-ser-securityh1fy24&mboxid=PC%2333be87796af745aba45a37283be836f8.32_0%231778190493%7Csession%23d8fc4378fdf64a3e8b8007d970b9c3aa%231714947553&adobe_mc=MCMID%3D29085826287016981395942979357405473398%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1714945692

Search URL Search Domain Scan URL

URL: https://www.anz.com.au/support?pid=glo-ibl-td-ib-04-21-ser-support&mboxid=PC%2333be87796af745aba45a37283be836f8.32_0%231778190493%7Csession%23d8fc4378fdf64a3e8b8007d970b9c3aa%231714947553&adobe_mc=MCMID%3D29085826287016981395942979357405473398%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1714945692
Title: Fraud protection. Now it’s personal.

Search URL Search Domain Scan URL

URL: https://www.anz.com.au/ways-to-bank/internet-banking/personal/whats-new/?mboxid=PC%2333be87796af745aba45a37283be836f8.32_0%231778190493%7Csession%23d8fc4378fdf64a3e8b8007d970b9c3aa%231714947553&adobe_mc=MCMID%3D29085826287016981395942979357405473398%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1714945692
Title: What’s new

Search URL Search Domain Scan URL

URL: https://www.anz.com.au/support/customer-registration-number-password/?mboxid=PC%2333be87796af745aba45a37283be836f8.32_0%231778190493%7Csession%23d8fc4378fdf64a3e8b8007d970b9c3aa%231714947553&adobe_mc=MCMID%3D29085826287016981395942979357405473398%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1714945692
Title: Find or change your CRN and Password

Search URL Search Domain Scan URL

URL: https://www.anz.com.au/support/statements/?mboxid=PC%2333be87796af745aba45a37283be836f8.32_0%231778190493%7Csession%23d8fc4378fdf64a3e8b8007d970b9c3aa%231714947553&adobe_mc=MCMID%3D29085826287016981395942979357405473398%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1714945692
Title: View statements

Search URL Search Domain Scan URL

URL: https://www.anz.com.au/personal/credit-cards/using/managing/?mboxid=PC%2333be87796af745aba45a37283be836f8.32_0%231778190493%7Csession%23d8fc4378fdf64a3e8b8007d970b9c3aa%231714947553&adobe_mc=MCMID%3D29085826287016981395942979357405473398%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1714945692#changepin
Title: Get or change your card PIN

Search URL Search Domain Scan URL

URL: https://www.anz.com.au/security/fraud-detection/latest-security-alerts/?mboxid=PC%2333be87796af745aba45a37283be836f8.32_0%231778190493%7Csession%23d8fc4378fdf64a3e8b8007d970b9c3aa%231714947553&adobe_mc=MCMID%3D29085826287016981395942979357405473398%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1714945692
Title: Latest security alerts

Search URL Search Domain Scan URL

URL: https://www.anz.com.au/support/contact-us/?mboxid=PC%2333be87796af745aba45a37283be836f8.32_0%231778190493%7Csession%23d8fc4378fdf64a3e8b8007d970b9c3aa%231714947553&adobe_mc=MCMID%3D29085826287016981395942979357405473398%7CMCORGID%3D67A216D751E567B20A490D4C%2540AdobeOrg%7CTS%3D1714945692
Title: Contact us

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://pub-8b7b3acc9111415d915db93c86c75e53.r2.dev/5.html HTTP 307
https://pub-8b7b3acc9111415d915db93c86c75e53.r2.dev/5.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions
5 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request 5.html Show response
pub-8b7b3acc9111415d915db93c86c75e53.r2.dev/
Redirect Chain

http://pub-8b7b3acc9111415d915db93c86c75e53.r2.dev/5.html
https://pub-8b7b3acc9111415d915db93c86c75e53.r2.dev/5.html

562 KB
562 KB

383ms
317ms

Document
text/html

2606:4700::6812:323
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pub-8b7b3acc9111415d915db93c86c75e53.r2.dev/5.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:323 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9d74d1810c80336a13372fa7c360e61a85721430ec44baedb50b0ab99169cd2d

Request headers

Accept-Language: fr-FR,fr;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
CF-RAY: 884d4b72fb9ed3fc-CDG
Connection: keep-alive
Content-Length: 575199
Content-Type: text/html
Date: Thu, 16 May 2024 18:05:14 GMT
ETag: "bcb86e203e1912457404e97bca2fe4e8"
Last-Modified: Mon, 06 May 2024 15:56:21 GMT
Server: cloudflare
Vary: Accept-Encoding

Redirect headers

Cross-Origin-Resource-Policy: Cross-Origin
Location: https://pub-8b7b3acc9111415d915db93c86c75e53.r2.dev/5.html
Non-Authoritative-Reason: HSTS

GET
DATA 200
OK truncated
/ 38 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: df477d03866885295a31b44c475bc6150273fc522c3bd5c1db69478650ebc2a5

Request headers

Accept-Language: fr-FR,fr;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 51 KB
51 KB Font
font/woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9af4df3b7f044525975716b175351fa75553070734627cf3b1325332284208c5

Request headers

Referer
Origin: https://pub-8b7b3acc9111415d915db93c86c75e53.r2.dev
Accept-Language: fr-FR,fr;q=0.9;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

Content-Type: font/woff

GET
DATA 200
OK truncated
/ 52 KB
52 KB Font
font/woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b6bf163550dd994ccb01b937f1210281ec8681bfea58b38cf92b266a3d257cfc

Request headers

Referer
Origin: https://pub-8b7b3acc9111415d915db93c86c75e53.r2.dev
Accept-Language: fr-FR,fr;q=0.9;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

Content-Type: font/woff

GET
DATA 200
OK truncated
/ 51 KB
51 KB Font
font/woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a3080630cedf7c6bb87229c4b11d206b3adb83753ced5558c7fea114bc0fd87a

Request headers

Referer
Origin: https://pub-8b7b3acc9111415d915db93c86c75e53.r2.dev
Accept-Language: fr-FR,fr;q=0.9;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

Content-Type: font/woff

GET
DATA 200
OK truncated
/ 169 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 439a65d5672ea217677bfb376155401fd3451b91ac7eff5fdc062f1ae560a546

Request headers

Accept-Language: fr-FR,fr;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.2.1/ 85 KB
30 KB 98ms
27ms Script
text/javascript 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js

Requested by

Host: pub-8b7b3acc9111415d915db93c86c75e53.r2.dev
URL: https://pub-8b7b3acc9111415d915db93c86c75e53.r2.dev/5.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
Accept-Language: fr-FR,fr;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 16 May 2024 12:13:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 21093
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30306
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 16 May 2025 12:13:41 GMT

GET
H2 200 / Show response
api.ipify.org/ 21 B
154 B 225ms
169ms XHR
application/json 172.67.74.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.ipify.org/?format=json
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.74.152 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2674a825f543bae7e5c09f103f1c25e660b79384e0e56b925c5e645b3279e3df

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Accept: application/json, text/javascript, */*; q=0.01
Referer
Accept-Language: fr-FR,fr;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 16 May 2024 18:05:14 GMT
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: application/json
access-control-allow-origin: *
cf-ray: 884d4b76fca62292-CDG
content-length: 21

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ANZ Bank (Banking)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://pub-8b7b3acc9111415d915db93c86c75e53.r2.dev/5.html Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
recommendation	verbose	URL: https://pub-8b7b3acc9111415d915db93c86c75e53.r2.dev/5.html Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
api.ipify.org
pub-8b7b3acc9111415d915db93c86c75e53.r2.dev
172.67.74.152
2606:4700::6812:323
2a00:1450:4001:808::200a
2674a825f543bae7e5c09f103f1c25e660b79384e0e56b925c5e645b3279e3df
439a65d5672ea217677bfb376155401fd3451b91ac7eff5fdc062f1ae560a546
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
9af4df3b7f044525975716b175351fa75553070734627cf3b1325332284208c5
9d74d1810c80336a13372fa7c360e61a85721430ec44baedb50b0ab99169cd2d
a3080630cedf7c6bb87229c4b11d206b3adb83753ced5558c7fea114bc0fd87a
b6bf163550dd994ccb01b937f1210281ec8681bfea58b38cf92b266a3d257cfc
df477d03866885295a31b44c475bc6150273fc522c3bd5c1db69478650ebc2a5

pub-8b7b3acc9111415d915db93c86c75e53.r2.dev Open in urlscan Pro 2606:4700::6812:323 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

3 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

4 IPs

2 Countries

746 kBTransfer

1007 kBSize

0 Cookies

12 Outgoing links

Page URL History

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

pub-8b7b3acc9111415d915db93c86c75e53.r2.dev Open in urlscan Pro
2606:4700::6812:323 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

746 kB
Transfer

1007 kB
Size

0
Cookies

3 HTTP transactions
5 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!