loginbnz.info Open in urlscan Pro
212.114.52.153 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://loginbnz.info/
Effective URL:
https://loginbnz.info/bz
Submission: On January 30 via manual (January 30th 2023, 12:51:14 am UTC) from NZ — Scanned from NZ

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 8 HTTP transactions. The main IP is 212.114.52.153, located in Germany and belongs to COMBAHTON combahton GmbH, DE. The main domain is loginbnz.info.
TLS certificate: Issued by R3 on January 29th 2023. Valid for: 3 months.

This is the only time loginbnz.info was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BNZ Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 8	212.114.52.153 212.114.52.153	30823 (COMBAHTON...) (COMBAHTON combahton GmbH)
1	69.16.175.10 69.16.175.10	20446 (STACKPATH...) (STACKPATH-CDN)
8	3

8 212.114.52.153 (Germany) 1 redirects

ASN30823 (COMBAHTON combahton GmbH, DE)

loginbnz.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.16.175.10 (United States)

ASN20446 (STACKPATH-CDN, US)
PTR: tlb.hwcdn.net

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	loginbnz.info 1 redirects loginbnz.info	430 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 673	31 KB
8	2

	Domain	Requested by
8	loginbnz.info	1 redirects loginbnz.info code.jquery.com
1	code.jquery.com	loginbnz.info
8	2

This site contains no links.

Subject Issuer	Validity	Valid
loginbnz.info R3	`2023-01-29` - `2023-04-29`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2022-08-03` - `2023-07-14`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://loginbnz.info/bz
Frame ID: AF9A811D7C0F476F254826D434F260AA
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Welcome

Page URL History Show full URLs

https://loginbnz.info/ HTTP 302
https://loginbnz.info/bz Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

499 kB
Transfer

554 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://loginbnz.info/ HTTP 302
https://loginbnz.info/bz Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request bz Show response loginbnz.info/ Redirect Chain https://loginbnz.info/ https://loginbnz.info/bz	5 KB 6 KB	1126ms 1126ms	Document text/html	212.114.52.153 COMBAHTON combaht...
General Check archive.org Show headers Download Go to Full URL https://loginbnz.info/bz Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 212.114.52.153 , Germany, ASN30823 (COMBAHTON combahton GmbH, DE), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 / PHP/7.4.33 Resource Hash `6666e8469cb8d5e7e20669f1e04316f5ba3a07692aede13676a828fc5f9337ca` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 accept-language en-NZ,en;q=0.9 Response headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Length 5507 Content-Type text/html; charset=UTF-8 Date Mon, 30 Jan 2023 00:51:05 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=99 Pragma no-cache Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 X-Powered-By PHP/7.4.33 Redirect headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Length 0 Content-Type text/html; charset=UTF-8 Date Mon, 30 Jan 2023 00:51:02 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=100 Pragma no-cache Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 X-Powered-By PHP/7.4.33 location /bz
GET H/1.1	200 OK	main.css loginbnz.info/assets/bz/css/	74 KB 74 KB	386ms 385ms	Stylesheet text/css	212.114.52.153 COMBAHTON combaht...
General Check archive.org Show headers Download Go to Full URL https://loginbnz.info/assets/bz/css/main.css Requested by Host: loginbnz.info URL: https://loginbnz.info/bz Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 212.114.52.153 , Germany, ASN30823 (COMBAHTON combahton GmbH, DE), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 / Resource Hash `31d3c6dd16db3671f74d1d8c83466bf59efce44028f85cfac9aaddbad3da1d78` Request headers accept-language en-NZ,en;q=0.9 Referer https://loginbnz.info/bz User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers Date Mon, 30 Jan 2023 00:51:06 GMT Last-Modified Wed, 26 Jan 2022 20:39:34 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 ETag "1261d-5d682330aed80" Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 75293
GET H/1.1	200 OK	jquery.js Show response loginbnz.info/assets/bz/js/	266 KB 266 KB	386ms 385ms	Script application/javascript	212.114.52.153 COMBAHTON combaht...
General Check archive.org Show headers Download Go to Full URL https://loginbnz.info/assets/bz/js/jquery.js Requested by Host: loginbnz.info URL: https://loginbnz.info/bz Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 212.114.52.153 , Germany, ASN30823 (COMBAHTON combahton GmbH, DE), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 / Resource Hash `4ef5f864f89db7feaaaa5332c0a99d76076af49fef488806541ca2561e4cb379` Request headers accept-language en-NZ,en;q=0.9 Referer https://loginbnz.info/bz User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers Date Mon, 30 Jan 2023 00:51:06 GMT Last-Modified Fri, 05 Feb 2021 10:11:28 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 ETag "4271b-5ba940b1e1400" Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 272155
GET H/1.1	200 OK	global.css loginbnz.info/assets/bz/	78 KB 79 KB	1154ms 385ms	Stylesheet text/css	212.114.52.153 COMBAHTON combaht...
General Check archive.org Show headers Download Go to Full URL https://loginbnz.info/assets/bz/global.css?1675039866 Requested by Host: loginbnz.info URL: https://loginbnz.info/bz Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 212.114.52.153 , Germany, ASN30823 (COMBAHTON combahton GmbH, DE), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 / Resource Hash `684ec77cd53c959e18b8d1eddf96412c68ab430c732dea0805bc37eba212b31d` Request headers accept-language en-NZ,en;q=0.9 Referer https://loginbnz.info/bz User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers Date Mon, 30 Jan 2023 00:51:07 GMT Last-Modified Thu, 03 Mar 2022 22:07:06 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 ETag "13911-5d9579e5f9680" Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 80145
GET H/1.1	200 OK	logo.png loginbnz.info/assets/bz/	3 KB 4 KB	385ms 385ms	Image image/png	212.114.52.153 COMBAHTON combaht...
General Check archive.org Show headers Download Go to Show image Full URL https://loginbnz.info/assets/bz/logo.png Requested by Host: loginbnz.info URL: https://loginbnz.info/bz Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 212.114.52.153 , Germany, ASN30823 (COMBAHTON combahton GmbH, DE), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 / Resource Hash `3396ac6b59a64c671beb8b2d7dbf9478a65808541022ed1c51c930b04168d325` Request headers accept-language en-NZ,en;q=0.9 Referer https://loginbnz.info/bz User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers Date Mon, 30 Jan 2023 00:51:08 GMT Last-Modified Mon, 31 Jan 2022 08:49:20 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 ETag "cf7-5d6dcdc41c400" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 3319
GET H2	200	jquery-3.6.0.min.js Show response code.jquery.com/	87 KB 31 KB	842ms 279ms	Script application/javascript	69.16.175.10 STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.6.0.min.js Requested by Host: loginbnz.info URL: https://loginbnz.info/bz Protocol H2 Security TLS 1.3, , AES_128_GCM Server 69.16.175.10 , United States, ASN20446 (STACKPATH-CDN, US), Reverse DNS tlb.hwcdn.net Software nginx / Resource Hash `ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e` Request headers Referer https://loginbnz.info/ Origin https://loginbnz.info accept-language en-NZ,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers date Mon, 30 Jan 2023 00:51:09 GMT content-encoding gzip x-sp-metadata HS256.CI3F3J4GEogBCiQwZDRhZDkzZC1iZjBkLTQ0MTgtYmNhOS0xNDQ5Y2M1OWQ0NzEQ+OiCoKvU+wIaBgj9qNyeBiINMTE2LjkwLjc0LjIwMiiGlQMwAzgEQhZUTFNfQUVTXzEyOF9HQ01fU0hBMjU2WiAzZTliMjA2MTAwOThiNmM5YmZmOTUzODU2ZTU4MDE2YRosCAESJGFhZThmZWVkLTlhMDQtNDE3YS05MGIwLTdlNTViOGRmOGZjORib8QEiGAgCEhRjZHMyNjcubGEzLmh3Y2RuLm5ldA==.vXa70OktL3coyvaQMkd5X8phO4xm3hA17a1eG+o4xEY= last-modified Wed, 16 Feb 2022 10:50:39 GMT server nginx etag W/"620cd6ff-15d9d" vary Accept-Encoding x-hw 1675039869.dop111.la3.t,1675039869.cds107.la3.hn,1675039869.cds267.la3.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30875
GET H/1.1	200 OK	actions.js Show response loginbnz.info/assets/js/	644 B 971 B	385ms 385ms	Script application/javascript	212.114.52.153 COMBAHTON combaht...
General Check archive.org Show headers Download Go to Full URL https://loginbnz.info/assets/js/actions.js?v=1675039866 Requested by Host: loginbnz.info URL: https://loginbnz.info/bz Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 212.114.52.153 , Germany, ASN30823 (COMBAHTON combahton GmbH, DE), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 / Resource Hash `3160a5af41fcdd11075c6d9e50c91790151aefd58e4a1416ab5fd9ef230e0033` Request headers accept-language en-NZ,en;q=0.9 Referer https://loginbnz.info/bz User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers Date Mon, 30 Jan 2023 00:51:08 GMT Last-Modified Thu, 29 Jul 2021 14:18:16 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 ETag "284-5c843c6217a00" Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 644
GET DATA	200 OK	truncated /	21 KB 21 KB		Font application/font-woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `00597164b7643a1a0040f59fe7167231ba550754b16f0c7df456d7490698ba11` Request headers Referer Origin https://loginbnz.info accept-language en-NZ,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers Content-Type application/font-woff2
GET DATA	200 OK	truncated /	19 KB 19 KB		Font application/font-woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `9e63cdc77de3df5b0b0685849e03d263716a22ccf56e4ed74807504dc227221c` Request headers Referer Origin https://loginbnz.info accept-language en-NZ,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers Content-Type application/font-woff2
POST H/1.1	200 OK	action Show response loginbnz.info/apis/lr/	25 B 394 B	1199ms 1199ms	XHR text/html	212.114.52.153 COMBAHTON combaht...
General Check archive.org Show headers Download Go to Full URL https://loginbnz.info/apis/lr/action Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.6.0.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 212.114.52.153 , Germany, ASN30823 (COMBAHTON combahton GmbH, DE), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 / PHP/7.4.33 Resource Hash `c1cbbd152a050ee0dc982af665d16b3508db3942527b4b1d65aff0127244ac9e` Request headers Accept / Referer https://loginbnz.info/bz X-Requested-With XMLHttpRequest accept-language en-NZ,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers Pragma no-cache Date Mon, 30 Jan 2023 00:51:10 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 X-Powered-By PHP/7.4.33 Content-Type text/html; charset=UTF-8 Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Keep-Alive timeout=5, max=98 Content-Length 25 Expires Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BNZ Bank (Banking)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			loginbnz.info/	1969-12-31 23:59:59	Name: PHPSESSID Value: rbpor32p1vge5h8dgv0a6162em

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
loginbnz.info
212.114.52.153
69.16.175.10
00597164b7643a1a0040f59fe7167231ba550754b16f0c7df456d7490698ba11
3160a5af41fcdd11075c6d9e50c91790151aefd58e4a1416ab5fd9ef230e0033
31d3c6dd16db3671f74d1d8c83466bf59efce44028f85cfac9aaddbad3da1d78
3396ac6b59a64c671beb8b2d7dbf9478a65808541022ed1c51c930b04168d325
4ef5f864f89db7feaaaa5332c0a99d76076af49fef488806541ca2561e4cb379
6666e8469cb8d5e7e20669f1e04316f5ba3a07692aede13676a828fc5f9337ca
684ec77cd53c959e18b8d1eddf96412c68ab430c732dea0805bc37eba212b31d
9e63cdc77de3df5b0b0685849e03d263716a22ccf56e4ed74807504dc227221c
c1cbbd152a050ee0dc982af665d16b3508db3942527b4b1d65aff0127244ac9e
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

loginbnz.info Open in urlscan Pro 212.114.52.153 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

8 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

499 kBTransfer

554 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

1 Cookies

Indicators

loginbnz.info Open in urlscan Pro
212.114.52.153 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

499 kB
Transfer

554 kB
Size

1
Cookies

8 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!