nabsecure.com.au
Open in
urlscan Pro
203.210.102.125
Malicious Activity!
Public Scan
Submission Tags: 7397608
Submission: On December 28 via api from US — Scanned from DE
Summary
This is the only time nabsecure.com.au was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: NAB Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 | 203.210.102.125 203.210.102.125 | 24446 (NETREGIST...) (NETREGISTRY-AS-AP NetRegistry Pty Ltd.) | |
1 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:3b | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
1 | 192.0.78.20 192.0.78.20 | 2635 (AUTOMATTIC) (AUTOMATTIC) | |
1 | 192.0.77.2 192.0.77.2 | 2635 (AUTOMATTIC) (AUTOMATTIC) | |
1 | 2a00:1450:400... 2a00:1450:4001:827::200a | 15169 (GOOGLE) (GOOGLE) | |
7 | 6 |
ASN24446 (NETREGISTRY-AS-AP NetRegistry Pty Ltd., AU)
PTR: sdc-cp125.server-cpanel.com
nabsecure.com.au |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
nabsecure.com.au
nabsecure.com.au |
380 KB |
1 |
googleapis.com
fonts.googleapis.com |
1 KB |
1 |
wp.com
i0.wp.com |
514 B |
1 |
wpcomstaging.com
mcqau.wpcomstaging.com |
2 KB |
1 |
jquery.com
code.jquery.com |
30 KB |
7 | 5 |
Domain | Requested by | |
---|---|---|
3 | nabsecure.com.au |
nabsecure.com.au
|
1 | fonts.googleapis.com |
nabsecure.com.au
|
1 | i0.wp.com |
nabsecure.com.au
|
1 | mcqau.wpcomstaging.com |
nabsecure.com.au
|
1 | code.jquery.com |
nabsecure.com.au
|
7 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
mcqau.wpcomstaging.com |
ib.nab.com.au |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2021-07-14 - 2022-08-14 |
a year | crt.sh |
*.wpcomstaging.com Sectigo RSA Domain Validation Secure Server CA |
2021-10-06 - 2022-11-06 |
a year | crt.sh |
*.wp.com Sectigo RSA Domain Validation Secure Server CA |
2020-04-02 - 2022-07-05 |
2 years | crt.sh |
upload.video.google.com GTS CA 1C3 |
2021-11-29 - 2022-02-21 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://nabsecure.com.au/login.php
Frame ID: 2D9E4E09C09F8418390645BBF3829DF0
Requests: 8 HTTP requests in this frame
Screenshot
Page Title
Internet BankingANZ Internet Banking - LoginDetected technologies
WordPress (CMS) ExpandDetected patterns
- /wp-(?:content|includes)/
PHP (Programming Languages) Expand
Detected patterns
- \.php(?:$|\?)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: Forgot customer ID or password?
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
login.php
nabsecure.com.au/ |
357 KB 357 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.5.1.min.js
code.jquery.com/ |
87 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.loadingModal.min.js
nabsecure.com.au/assets/js/ |
7 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.loadingModal.min.css
nabsecure.com.au/assets/css/ |
16 KB 16 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
star_nab_more.a3e1121c24cb2bd0957c143488ba84c9.svg
mcqau.wpcomstaging.com/wp-content/uploads/2021/12/ |
5 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lock_v1-1.png
i0.wp.com/mcqau.wpcomstaging.com/wp-content/uploads/2021/11/ |
200 B 514 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: NAB Bank (Banking)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| savepage_ShadowLoader function| $ function| jQuery boolean| allow_redirect string| current_page function| heartbeat0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
fonts.googleapis.com
i0.wp.com
mcqau.wpcomstaging.com
nabsecure.com.au
192.0.77.2
192.0.78.20
2001:4de0:ac18::1:a:3b
203.210.102.125
2a00:1450:4001:827::200a
267d912e0f06afd6d687237d658cdb12737185b9730493e66a5637307a6a5011
43ba19a87cfa987a34f01807aa0588a4491cbeb46d67a7cd7277b8baac4eb08d
5104bfb80275b5f6a7803805c9ab76b0b4da9cca560eb98a6756c15179d95d30
8386da17dbd5b25d5510f0d58b663b5c31e15d93531caa44029b63b5ecb2d687
bd00ae701afd4ca40b796cf3548c687a54074bf38a3acb4f1165af05eee88224
c99361c0d8561c7d88a237009bac83ecc149fe6f1f91c52dde79b7841b584c40
db23f96e265a441082c50587b660ba7ee4729cc78e01c887bfa1c00bbf97d045
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d