URL: http://chketon1.tk/rev/WestPac/index.html
Submission: On May 07 via automatic, source openphish — Scanned from DE

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 9 HTTP transactions. The main IP is 162.240.230.249, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is chketon1.tk.
This is the only time chketon1.tk was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Westpac (Banking)

Domain & IP information

IP Address AS Autonomous System
2 162.240.230.249 46606 (UNIFIEDLA...)
7 110.5.81.221 9426 (WESTPAC-A...)
9 2
Apex Domain
Subdomains
Transfer
7 westpac.com.au
banking.westpac.com.au — Cisco Umbrella Rank: 668850
101 KB
2 chketon1.tk
chketon1.tk
12 KB
9 2
Domain Requested by
7 banking.westpac.com.au chketon1.tk
banking.westpac.com.au
2 chketon1.tk chketon1.tk
9 2

This site contains links to these domains. Also see Links.

Domain
www.westpac.com.au
Subject Issuer Validity Valid
banking.westpac.com.au
Entrust Certification Authority - L1M
2023-03-10 -
2024-04-10
a year crt.sh

This page contains 1 frames:

Primary Page: http://chketon1.tk/rev/WestPac/index.html
Frame ID: 150B80EBECA2189A5CF81F2074DE1A79
Requests: 9 HTTP requests in this frame

Screenshot

Page Title

Sign in to Westpac Online Banking

Page Statistics

9
Requests

78 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

113 kB
Transfer

338 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request index.html
chketon1.tk/rev/WestPac/
10 KB
11 KB
Document
General
Full URL
http://chketon1.tk/rev/WestPac/index.html
Protocol
HTTP/1.1
Server
162.240.230.249 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
6880556.qkuwar.ga
Software
Apache /
Resource Hash
1f57abd0c87c47d6af5eab96e6a67123d123ddad95080664df29ddd4dc863e44

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Connection
Upgrade, Keep-Alive
Content-Length
10709
Content-Type
text/html
Date
Sun, 07 May 2023 06:22:02 GMT
Keep-Alive
timeout=5, max=100
Last-Modified
Sat, 28 Jan 2023 15:17:08 GMT
Server
Apache
Upgrade
h2,h2c
000-000-0001combined.css.1a6232cd07874834478c928fa1f30b79eea8fe08.css
banking.westpac.com.au/wbc/banking/Themes/Default/Desktop/WBC/Core/
154 B
1 KB
Stylesheet
General
Full URL
https://banking.westpac.com.au/wbc/banking/Themes/Default/Desktop/WBC/Core/000-000-0001combined.css.1a6232cd07874834478c928fa1f30b79eea8fe08.css
Requested by
Host: chketon1.tk
URL: http://chketon1.tk/rev/WestPac/index.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
110.5.81.221 Sydney, Australia, ASN9426 (WESTPAC-AS-AP Westpac Bank, AU),
Reverse DNS
Software
/
Resource Hash
90625e6164330d2eb9e1bf01a00e54f83eb18e1b307517dc94207e366b967047
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://*.westpac.com.au
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://chketon1.tk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date
Sun, 07 May 2023 06:22:05 GMT
content-security-policy
frame-ancestors 'self' https://*.westpac.com.au
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Sat, 15 Apr 2023 00:00:00 GMT
referrer-policy
no-referrer-when-downgrade
etag
"00b9382d6fd91:0"
Vary
Accept-Encoding
p3p
CP="NON CUR OTPi OUR NOR UNI"
content-type
text/css
cache-control
max-age=31536000
accept-ranges
bytes
content-length
154
x-xss-protection
1; mode=block
x-ua-compatible
IE=8;FF=3;OtherUA=4
000-0001combined.css.ad6781636bef282d22c7bf9fd591fb26c16140da.css
banking.westpac.com.au/wbc/banking/Themes/Default/Desktop/WBC/Core/
214 KB
56 KB
Stylesheet
General
Full URL
https://banking.westpac.com.au/wbc/banking/Themes/Default/Desktop/WBC/Core/000-0001combined.css.ad6781636bef282d22c7bf9fd591fb26c16140da.css
Requested by
Host: chketon1.tk
URL: http://chketon1.tk/rev/WestPac/index.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
110.5.81.221 Sydney, Australia, ASN9426 (WESTPAC-AS-AP Westpac Bank, AU),
Reverse DNS
Software
/
Resource Hash
3adc14443a2d84ae538fc0f9d19a1e1f6ced4345f85e34a12f4ae4d6ba553b61
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://*.westpac.com.au
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://chketon1.tk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date
Sun, 07 May 2023 06:22:06 GMT
content-security-policy
frame-ancestors 'self' https://*.westpac.com.au
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
Content-Encoding
gzip
Transfer-Encoding
chunked
p3p
CP="NON CUR OTPi OUR NOR UNI"
x-xss-protection
1; mode=block
x-ua-compatible
IE=8;FF=3;OtherUA=4
referrer-policy
no-referrer-when-downgrade
last-modified
Sat, 15 Apr 2023 00:00:00 GMT
etag
"00b9382d6fd91:0"
Vary
Accept-Encoding
content-type
text/css
cache-control
max-age=31536000
accept-ranges
bytes
000-0001combined.css.b0cf37060ddf80c0f0adf1583668a8d44dfb5143.css
banking.westpac.com.au/wbc/banking/Themes/Default/Desktop/WBC/Fiserv.PS.Authentication/
94 KB
22 KB
Stylesheet
General
Full URL
https://banking.westpac.com.au/wbc/banking/Themes/Default/Desktop/WBC/Fiserv.PS.Authentication/000-0001combined.css.b0cf37060ddf80c0f0adf1583668a8d44dfb5143.css
Requested by
Host: chketon1.tk
URL: http://chketon1.tk/rev/WestPac/index.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
110.5.81.221 Sydney, Australia, ASN9426 (WESTPAC-AS-AP Westpac Bank, AU),
Reverse DNS
Software
/
Resource Hash
1072735c320f761ea30ae9f78b1d421172281739088a8416303cd4fbebe05270
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://*.westpac.com.au
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://chketon1.tk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date
Sun, 07 May 2023 06:22:06 GMT
content-security-policy
frame-ancestors 'self' https://*.westpac.com.au
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
Content-Encoding
gzip
Transfer-Encoding
chunked
p3p
CP="NON CUR OTPi OUR NOR UNI"
x-xss-protection
1; mode=block
x-ua-compatible
IE=8;FF=3;OtherUA=4
referrer-policy
no-referrer-when-downgrade
last-modified
Sat, 15 Apr 2023 00:00:00 GMT
etag
"00b9382d6fd91:0"
Vary
Accept-Encoding
content-type
text/css
cache-control
max-age=31536000
accept-ranges
bytes
logo_white_bg.png.ce5c4c19ec61b56796f0e218fc8329c558421fd8.png
chketon1.tk/rev/WestPac/images/
1 KB
1 KB
Image
General
Full URL
http://chketon1.tk/rev/WestPac/images/logo_white_bg.png.ce5c4c19ec61b56796f0e218fc8329c558421fd8.png
Requested by
Host: chketon1.tk
URL: http://chketon1.tk/rev/WestPac/index.html
Protocol
HTTP/1.1
Server
162.240.230.249 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
6880556.qkuwar.ga
Software
Apache /
Resource Hash
cf1c352b986e083292b5713ac5556b02832a8cf248485e627708110e62a83820

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://chketon1.tk/rev/WestPac/index.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Date
Sun, 07 May 2023 06:22:02 GMT
Last-Modified
Fri, 27 Jan 2023 23:37:06 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
1183
StandardSignInRibbon.png.4f505a909d6a96b07fe521d44051d96801184d82.png
banking.westpac.com.au/wbc/banking/Themes/Default/Desktop/WBC/Fiserv.PS.Authentication/Images/
172 B
1 KB
Image
General
Full URL
https://banking.westpac.com.au/wbc/banking/Themes/Default/Desktop/WBC/Fiserv.PS.Authentication/Images/StandardSignInRibbon.png.4f505a909d6a96b07fe521d44051d96801184d82.png?preserve-inactive-time=true
Requested by
Host: banking.westpac.com.au
URL: https://banking.westpac.com.au/wbc/banking/Themes/Default/Desktop/WBC/Fiserv.PS.Authentication/000-0001combined.css.b0cf37060ddf80c0f0adf1583668a8d44dfb5143.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
110.5.81.221 Sydney, Australia, ASN9426 (WESTPAC-AS-AP Westpac Bank, AU),
Reverse DNS
Software
/
Resource Hash
06b806e1ac0dcd5c55eecef5fba60cc9a9ba999d2e85e36f5c88c2200da863e7
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://*.westpac.com.au
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://banking.westpac.com.au/wbc/banking/Themes/Default/Desktop/WBC/Fiserv.PS.Authentication/000-0001combined.css.b0cf37060ddf80c0f0adf1583668a8d44dfb5143.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date
Sun, 07 May 2023 06:22:06 GMT
content-security-policy
frame-ancestors 'self' https://*.westpac.com.au
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Wed, 05 Apr 2023 09:14:34 GMT
referrer-policy
no-referrer-when-downgrade
etag
"d01bab99f67d91:0"
Vary
Accept-Encoding
p3p
CP="NON CUR OTPi OUR NOR UNI"
content-type
image/png
cache-control
max-age=31536000
accept-ranges
bytes
content-length
172
x-xss-protection
1; mode=block
x-ua-compatible
IE=8;FF=3;OtherUA=4
padlock-icon-v2.png.600e24c5da08eebbbee193c94b5d476d9269b51a.png
banking.westpac.com.au/wbc/banking/Themes/Default/Desktop/WBC/Fiserv.PS.Authentication/Images/
466 B
1 KB
Image
General
Full URL
https://banking.westpac.com.au/wbc/banking/Themes/Default/Desktop/WBC/Fiserv.PS.Authentication/Images/padlock-icon-v2.png.600e24c5da08eebbbee193c94b5d476d9269b51a.png?preserve-inactive-time=true
Requested by
Host: banking.westpac.com.au
URL: https://banking.westpac.com.au/wbc/banking/Themes/Default/Desktop/WBC/Fiserv.PS.Authentication/000-0001combined.css.b0cf37060ddf80c0f0adf1583668a8d44dfb5143.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
110.5.81.221 Sydney, Australia, ASN9426 (WESTPAC-AS-AP Westpac Bank, AU),
Reverse DNS
Software
/
Resource Hash
6973b22376b0cfcb74403c7f558140ca37d89685e53fe11472ab4b470a85aa6a
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://*.westpac.com.au
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://banking.westpac.com.au/wbc/banking/Themes/Default/Desktop/WBC/Fiserv.PS.Authentication/000-0001combined.css.b0cf37060ddf80c0f0adf1583668a8d44dfb5143.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date
Sun, 07 May 2023 06:22:07 GMT
content-security-policy
frame-ancestors 'self' https://*.westpac.com.au
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Wed, 05 Apr 2023 09:14:34 GMT
referrer-policy
no-referrer-when-downgrade
etag
"c047b299f67d91:0"
Vary
Accept-Encoding
p3p
CP="NON CUR OTPi OUR NOR UNI"
content-type
image/png
cache-control
max-age=31536000
accept-ranges
bytes
content-length
466
x-xss-protection
1; mode=block
x-ua-compatible
IE=8;FF=3;OtherUA=4
white-chevron.png.75a6ec48e7b0b941f3fada64c3def1875b1f7591.png
banking.westpac.com.au/wbc/banking/Themes/Default/Desktop/WBC/Fiserv.PS.Authentication/Images/
223 B
1 KB
Image
General
Full URL
https://banking.westpac.com.au/wbc/banking/Themes/Default/Desktop/WBC/Fiserv.PS.Authentication/Images/white-chevron.png.75a6ec48e7b0b941f3fada64c3def1875b1f7591.png?preserve-inactive-time=true
Requested by
Host: banking.westpac.com.au
URL: https://banking.westpac.com.au/wbc/banking/Themes/Default/Desktop/WBC/Fiserv.PS.Authentication/000-0001combined.css.b0cf37060ddf80c0f0adf1583668a8d44dfb5143.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
110.5.81.221 Sydney, Australia, ASN9426 (WESTPAC-AS-AP Westpac Bank, AU),
Reverse DNS
Software
/
Resource Hash
fd8ff5ab6aae4e32a9798a7f13d3d913f82a749cb2039eeb94aa0c2f71456827
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://*.westpac.com.au
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://banking.westpac.com.au/wbc/banking/Themes/Default/Desktop/WBC/Fiserv.PS.Authentication/000-0001combined.css.b0cf37060ddf80c0f0adf1583668a8d44dfb5143.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date
Sun, 07 May 2023 06:22:06 GMT
content-security-policy
frame-ancestors 'self' https://*.westpac.com.au
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Wed, 05 Apr 2023 09:14:34 GMT
referrer-policy
no-referrer-when-downgrade
etag
"c0b8b499f67d91:0"
Vary
Accept-Encoding
p3p
CP="NON CUR OTPi OUR NOR UNI"
content-type
image/png
cache-control
max-age=31536000
accept-ranges
bytes
content-length
223
x-xss-protection
1; mode=block
x-ua-compatible
IE=8;FF=3;OtherUA=4
red_arrow_icon.png.50687ff84190c3c102b0e9b867229854cb61bec9.png
banking.westpac.com.au/wbc/banking/Themes/Default/Desktop/WBC/Fiserv.PS.Authentication/Images/
18 KB
18 KB
Image
General
Full URL
https://banking.westpac.com.au/wbc/banking/Themes/Default/Desktop/WBC/Fiserv.PS.Authentication/Images/red_arrow_icon.png.50687ff84190c3c102b0e9b867229854cb61bec9.png?preserve-inactive-time=true
Requested by
Host: banking.westpac.com.au
URL: https://banking.westpac.com.au/wbc/banking/Themes/Default/Desktop/WBC/Fiserv.PS.Authentication/000-0001combined.css.b0cf37060ddf80c0f0adf1583668a8d44dfb5143.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
110.5.81.221 Sydney, Australia, ASN9426 (WESTPAC-AS-AP Westpac Bank, AU),
Reverse DNS
Software
/
Resource Hash
375c21b6f1883e77283613efec7b44651124cce1a873df52659b43a8e8cdbe4e
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://*.westpac.com.au
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://banking.westpac.com.au/wbc/banking/Themes/Default/Desktop/WBC/Fiserv.PS.Authentication/000-0001combined.css.b0cf37060ddf80c0f0adf1583668a8d44dfb5143.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date
Sun, 07 May 2023 06:22:07 GMT
content-security-policy
frame-ancestors 'self' https://*.westpac.com.au
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Wed, 05 Apr 2023 09:14:34 GMT
referrer-policy
no-referrer-when-downgrade
etag
"c0b8b499f67d91:0"
p3p
CP="NON CUR OTPi OUR NOR UNI"
content-type
image/png
cache-control
max-age=31536000
accept-ranges
bytes
content-length
17991
x-xss-protection
1; mode=block
x-ua-compatible
IE=8;FF=3;OtherUA=4

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Westpac (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless

0 Cookies