![](/screenshots/2be0064a-0be2-4470-b8f2-ee9856a2a785.png)
www.westpac.limited
Open in
urlscan Pro
35.244.80.173
Malicious Activity!
Public Scan
Submission: On June 10 via manual from DE
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on June 10th 2019. Valid for: 3 months.
This is the only time www.westpac.limited was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Westpac (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
8 | 35.244.80.173 35.244.80.173 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
3 | 52.72.79.100 52.72.79.100 | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
1 | 2a00:1450:400... 2a00:1450:4001:81a::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 203.24.3.4 203.24.3.4 | 9426 (WESTPAC-A...) (WESTPAC-AS-AP Westpac Bank) | |
15 | 5 |
ASN15169 (GOOGLE - Google LLC, US)
PTR: 173.80.244.35.bc.googleusercontent.com
www.westpac.limited |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-72-79-100.compute-1.amazonaws.com
upcode.editor.multiscreensite.com |
ASN15169 (GOOGLE - Google LLC, US)
ajax.googleapis.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
westpac.limited
www.westpac.limited |
351 KB |
3 |
multiscreensite.com
upcode.editor.multiscreensite.com |
58 KB |
1 |
westpac.com.au
banking.westpac.com.au |
4 KB |
1 |
googleapis.com
ajax.googleapis.com |
29 KB |
15 | 4 |
Domain | Requested by | |
---|---|---|
8 | www.westpac.limited |
www.westpac.limited
upcode.editor.multiscreensite.com |
3 | upcode.editor.multiscreensite.com |
www.westpac.limited
|
1 | banking.westpac.com.au |
www.westpac.limited
|
1 | ajax.googleapis.com |
www.westpac.limited
|
15 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.westpac.com.au |
banking.westpac.com.au |
Subject Issuer | Validity | Valid | |
---|---|---|---|
westpac.limited Let's Encrypt Authority X3 |
2019-06-10 - 2019-09-08 |
3 months | crt.sh |
multiscreensite.com Let's Encrypt Authority X3 |
2019-06-10 - 2019-09-08 |
3 months | crt.sh |
*.googleapis.com Google Internet Authority G3 |
2019-05-21 - 2019-08-13 |
3 months | crt.sh |
banking.westpac.com.au Entrust Certification Authority - L1M |
2018-04-06 - 2020-04-06 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.westpac.limited/
Frame ID: 4F813614E0DA6037B828BD116441FD07
Requests: 15 HTTP requests in this frame
Screenshot
![](/screenshots/2be0064a-0be2-4470-b8f2-ee9856a2a785.png)
Detected technologies
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Detected patterns
- env /^Modernizr$/i
Detected patterns
- script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
13 Outgoing links
These are links going to different origins than the main page.
Title: Forgot customer ID or password?
Search URL Search Domain Scan URL
Title: Register for Online Banking
Search URL Search Domain Scan URL
Title: Online Banking Help
Search URL Search Domain Scan URL
Title: Online security
Search URL Search Domain Scan URL
Title: What's new
Search URL Search Domain Scan URL
Title: Online Banking features
Search URL Search Domain Scan URL
Title: Contact us in the Westpac App
Search URL Search Domain Scan URL
Title: Security Guarantee
Search URL Search Domain Scan URL
Title: Keep safe online
Search URL Search Domain Scan URL
Title: Types of scams
Search URL Search Domain Scan URL
Title: Accessibility
Search URL Search Domain Scan URL
Title: Supported devices
Search URL Search Domain Scan URL
Title: Terms and Conditions
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
www.westpac.limited/ |
29 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
nee-css-font-package.min.css
upcode.editor.multiscreensite.com/mb/_dm/s/rt/dist/css/ |
162 KB 27 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
d-css-runtime-mobile-package.min.css
upcode.editor.multiscreensite.com/mb/_dm/s/rt/dist/css/ |
126 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
test.css
www.westpac.limited/westpac/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
westpac.css
www.westpac.limited/westpac/ |
210 KB 211 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
util.js
www.westpac.limited/mb/editor/scripts/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.1.1/ |
82 KB 29 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wp_preview.js
upcode.editor.multiscreensite.com/mb/editor/scripts/ |
27 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
goback.png
www.westpac.limited/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo_200.png.a63c92bece6e2a0644b657cc3054f7b63f870b58.png
banking.westpac.com.au/wbc/banking/Themes/Default/Desktop/WBC/Core/Images/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
form.css
www.westpac.limited/westpac/ |
128 KB 129 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
util.js
www.westpac.limited/mb/editor/scripts/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon-link-arrow-r.png.50e9132e1ac4da911ae78e2b49bd44d033eb3af3.png
www.westpac.limited/westpac/Images/Patterns1.1/ |
808 B 808 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
fontawesome-webfont.woff
upcode.editor.multiscreensite.com/mb/_dm/s/rt/css/font-icons/font-awesome/font/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
fontawesome-webfont.ttf
upcode.editor.multiscreensite.com/mb/_dm/s/rt/css/font-icons/font-awesome/font/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- upcode.editor.multiscreensite.com
- URL
- https://upcode.editor.multiscreensite.com/mb/_dm/s/rt/css/font-icons/font-awesome/font/fontawesome-webfont.woff?v=6
- Domain
- upcode.editor.multiscreensite.com
- URL
- https://upcode.editor.multiscreensite.com/mb/_dm/s/rt/css/font-icons/font-awesome/font/fontawesome-webfont.ttf?v=6
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Westpac (Banking)85 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask boolean| isWLR function| buildEditorParent boolean| isMultiScreen object| editorParent object| previewParent string| assetsCacheQueryParam object| customWidgetsFunctions function| $ function| jQuery boolean| previewPopUp string| rconfWar function| showLoadingDots function| showLoadingDotsNEW function| hideLoading function| getElementProperty function| getStyleProp function| replaceAll function| setTempCss function| isIE function| wpGetStyleSheet function| wpGetThemeStyleSheet function| wpGetHeaderPageStyleSheet function| wpGetHeaderPageDeviceStyleSheet function| wpGetPageStyleSheet function| wpGetPageDeviceStyleSheet function| _dmGetStyleSheet function| _getSpecificSheetNode function| cleanInlineStyle function| updateInlineStyle function| getInlineStyleAttribute function| getGlobalCSSToString function| getGlobalThemeCSSToString function| getPageCSSToString function| getPageDeviceCSSToString function| getHeaderPageCSSToString function| _dmCSSToString function| updateCssInternal function| updateCss function| prioritizeCss function| removeCssAttributesFromStyleSheet function| removeCssAttributes function| updateCssIEInternal function| updateCssIE function| removeCssAttributesIEInternal function| removeCssAttributesIE function| refreshGlobalCss function| refreshGlobalAndThemeCssInternal function| refreshGlobalCssInternal function| refreshGeneratedCss function| refreshGlobalCssInternalIE function| refreshPageStyleCss function| refreshPageStyleDeviceCss function| refreshGlobalCssAndShowLoading function| refreshGlobalCssAndShowLoadingNEW function| initComponents function| removeOldCss function| removeStyleAndReplace function| removeOldPageStyle function| removeOldDevicePageStyle function| updateLogoImage function| getLogoImageUrl function| getLogoImage function| getElementByID function| getHeader function| isThemeLogoImageHidden function| resetLogOImage function| setDMAjaxMoreNavigationParameter function| setDMAjaxNavSize function| setDMAjaxLessNavigationParameter function| setDMAjaxBackToHomeParameter function| getDMAjaxBackToHomeParameter function| isBackToHomeTextVisible function| isSiteHasMoreLessButtons function| loadStoreScript object| documentStyles function| _findCurrentNavText function| _findCurrentNavId function| styleImages object| Modernizr number| expireDays number| visitLength function| setSmartSiteCookies0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
banking.westpac.com.au
upcode.editor.multiscreensite.com
www.westpac.limited
upcode.editor.multiscreensite.com
203.24.3.4
2a00:1450:4001:81a::200a
35.244.80.173
52.72.79.100
3c463308d16b44b307ebbe530776a8884667e0dc5e683b5cd2ed9cd515035dfe
53182e67833270fd9ae2c35e17413f53c1124a7fade09497589411008753e24a
5425a459135db245e54b2ec02314683536862bf3294750c0eef99f3c3b210bfb
874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4
a990e2a0495895bbea44ba9b5fb6379664c59b147504da8384ad6019e9e857dd
b92bb8c6ff8baf8a3af45586da1863a0d280eb21c46f6b418f196bf368233290
b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187
c35ebaef57a8115d86bcd0f9a1522796fda3c103358a13e9665d2cbe53ee019a
cfaced42b102891e6ecb06ee984096542656b303f02b38becc9e5038ef0b750a
f203c716be7f29304171aaa7ec8e333d7d70b53fa2ffa217e563c28035862002