ip-160-153-244-20.ip.secureserver.net

Summary

This website contacted 4 IPs in 1 countries across 3 domains to perform 5 HTTP transactions. The main IP is 160.153.244.20, located in Scottsdale, United States and belongs to GODADDY, DE. The main domain is ip-160-153-244-20.ip.secureserver.net.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on September 25th 2020. Valid for: a year.

This is the only time ip-160-153-244-20.ip.secureserver.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: ANZ Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 4	160.153.244.20 160.153.244.20	20773 (GODADDY) (GODADDY)
1	2606:4700:20:... 2606:4700:20::ac43:4739	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	67.202.94.93 67.202.94.93	32748 (STEADFAST) (STEADFAST)
5	4

4 160.153.244.20 (Scottsdale, United States) 1 redirects

ASN20773 (GODADDY, DE)
PTR: ip-160-153-244-20.ip.secureserver.net

ip-160-153-244-20.ip.secureserver.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::ac43:4739 (United States)

ASN13335 (CLOUDFLARENET, US)

waust.at	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 67.202.94.93 (Chicago, United States)

ASN32748 (STEADFAST, US)
PTR: amung.us

whos.amung.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	secureserver.net 1 redirects ip-160-153-244-20.ip.secureserver.net	191 KB
1	amung.us whos.amung.us	144 B
1	waust.at waust.at	7 KB
5	3

	Domain	Requested by
4	ip-160-153-244-20.ip.secureserver.net	1 redirects ip-160-153-244-20.ip.secureserver.net
1	whos.amung.us	waust.at
1	waust.at	ip-160-153-244-20.ip.secureserver.net
5	3

This site contains links to these domains. Also see Links.

Domain
whos.amung.us

Subject Issuer	Validity	Valid
ip-160-153-244-20.ip.secureserver.net Sectigo RSA Domain Validation Secure Server CA	`2020-09-25` - `2021-10-25`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-09-04` - `2021-09-04`	a year	crt.sh
whos.amung.us Sectigo RSA Domain Validation Secure Server CA	`2020-05-21` - `2022-05-21`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://ip-160-153-244-20.ip.secureserver.net/personaldirect/
Frame ID: 34740027CE6E02970F4643E7154B58D2
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://ip-160-153-244-20.ip.secureserver.net/personaldirect HTTP 301
https://ip-160-153-244-20.ip.secureserver.net/personaldirect/ Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /php\/?([\d.]+)?/i

CentOS (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /CentOS/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

5
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

4
IPs

1
Countries

197 kB
Transfer

206 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://whos.amung.us/stats/7zilc9qtyo/
Title: 3

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://ip-160-153-244-20.ip.secureserver.net/personaldirect HTTP 301
https://ip-160-153-244-20.ip.secureserver.net/personaldirect/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response ip-160-153-244-20.ip.secureserver.net/personaldirect/ Redirect Chain https://ip-160-153-244-20.ip.secureserver.net/personaldirect https://ip-160-153-244-20.ip.secureserver.net/personaldirect/	5 KB 5 KB	86ms 85ms	Document text/html	160.153.244.20 GODADDY
General Check archive.org Show headers Download Go to Full URL https://ip-160-153-244-20.ip.secureserver.net/personaldirect/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 160.153.244.20 Scottsdale, United States, ASN20773 (GODADDY, DE), Reverse DNS ip-160-153-244-20.ip.secureserver.net Software Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/5.4.16 / Resource Hash `c733c0717db567c2909f3dc6dfed9a7ff1f1ad92344c54e5d4103ed9b6b470a9` Request headers Host ip-160-153-244-20.ip.secureserver.net Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 29 Sep 2020 22:44:11 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/5.4.16 Last-Modified Sat, 26 Sep 2020 05:10:16 GMT ETag "1206-5b03072e3be00" Accept-Ranges bytes Content-Length 4614 Keep-Alive timeout=5, max=99 Connection Keep-Alive Content-Type text/html; charset=UTF-8 Redirect headers Date Tue, 29 Sep 2020 22:44:11 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/5.4.16 Location https://ip-160-153-244-20.ip.secureserver.net/personaldirect/ Content-Length 269 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	bu.png ip-160-153-244-20.ip.secureserver.net/personaldirect/	2 KB 2 KB	59ms 58ms	Image image/png	160.153.244.20 GODADDY
General Check archive.org Show headers Download Go to Show image Full URL https://ip-160-153-244-20.ip.secureserver.net/personaldirect/bu.png Requested by Host: ip-160-153-244-20.ip.secureserver.net URL: https://ip-160-153-244-20.ip.secureserver.net/personaldirect/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 160.153.244.20 Scottsdale, United States, ASN20773 (GODADDY, DE), Reverse DNS ip-160-153-244-20.ip.secureserver.net Software Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/5.4.16 / Resource Hash `49bbf56435544897679a2b22e528138f078f8ea1294be79c20de2dd5154c76e2` Request headers Referer https://ip-160-153-244-20.ip.secureserver.net/personaldirect/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 29 Sep 2020 22:44:11 GMT Last-Modified Mon, 14 Dec 2015 17:49:52 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/5.4.16 ETag "6b4-526df4cd2d000" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 1716
GET H2	200	d.js Show response waust.at/	13 KB 7 KB	27ms 12ms	Script application/x-javascript	2606:4700:20::ac43:4739 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://waust.at/d.js Requested by Host: ip-160-153-244-20.ip.secureserver.net URL: https://ip-160-153-244-20.ip.secureserver.net/personaldirect/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::ac43:4739 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `efa8c2057af08d12b4e74599705c6e88f36bda5f4ec712fe58d1286a159fcfa6` Request headers Referer https://ip-160-153-244-20.ip.secureserver.net/personaldirect/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 29 Sep 2020 22:44:11 GMT content-encoding br cf-cache-status HIT age 3183 status 200 cf-request-id 057da2b47b0000060559021200000001 last-modified Sun, 27 Sep 2020 04:15:44 GMT server cloudflare etag W/"5f7011f0-33b6" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * cache-control max-age=86400 cf-ray 5da93a33fc390605-FRA expires Wed, 30 Sep 2020 21:51:08 GMT
GET H/1.1	200 OK	bc.png ip-160-153-244-20.ip.secureserver.net/personaldirect/	183 KB 183 KB	113ms 58ms	Image image/png	160.153.244.20 GODADDY
General Check archive.org Show headers Download Go to Show image Full URL https://ip-160-153-244-20.ip.secureserver.net/personaldirect/bc.png Requested by Host: ip-160-153-244-20.ip.secureserver.net URL: https://ip-160-153-244-20.ip.secureserver.net/personaldirect/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 160.153.244.20 Scottsdale, United States, ASN20773 (GODADDY, DE), Reverse DNS ip-160-153-244-20.ip.secureserver.net Software Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/5.4.16 / Resource Hash `e25873f8fcffa37ff168cd3977f6d5ce784296bc9c68e8972ea9a4f58452e0af` Request headers Referer https://ip-160-153-244-20.ip.secureserver.net/personaldirect/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 29 Sep 2020 22:44:11 GMT Last-Modified Mon, 14 Dec 2015 17:48:56 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/5.4.16 ETag "2dbfd-526df497c5200" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 187389
GET H2	200	/ Show response whos.amung.us/pingjs/	28 B 144 B	449ms 151ms	Script text/javascript	67.202.94.93 STEADFAST
General Check archive.org Show headers Download Go to Full URL https://whos.amung.us/pingjs/?k=7zilc9qtyo&t=%7C%7C%20A%20N%20Z%20%7C%7C&c=d&y=&a=0&r=7337 Requested by Host: waust.at URL: https://waust.at/d.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 67.202.94.93 Chicago, United States, ASN32748 (STEADFAST, US), Reverse DNS amung.us Software / Resource Hash `b91573832198d79fb5c17c93d0614e6384c78a0d136a43c21e7e0fbf2dd2b3de` Request headers Referer https://ip-160-153-244-20.ip.secureserver.net/personaldirect/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Tue, 29 Sep 2020 22:44:11 GMT content-encoding gzip content-type text/javascript;charset=UTF-8
GET DATA	200 OK	truncated /	3 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `6f4587fb64cd2e7ce26ba21941c80f3ab8d28c257b73d04a87c949b32e4cde2d` Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ANZ Bank (Banking)

19 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ip-160-153-244-20.ip.secureserver.net
waust.at
whos.amung.us
160.153.244.20
2606:4700:20::ac43:4739
67.202.94.93
49bbf56435544897679a2b22e528138f078f8ea1294be79c20de2dd5154c76e2
6f4587fb64cd2e7ce26ba21941c80f3ab8d28c257b73d04a87c949b32e4cde2d
b91573832198d79fb5c17c93d0614e6384c78a0d136a43c21e7e0fbf2dd2b3de
c733c0717db567c2909f3dc6dfed9a7ff1f1ad92344c54e5d4103ed9b6b470a9
e25873f8fcffa37ff168cd3977f6d5ce784296bc9c68e8972ea9a4f58452e0af
efa8c2057af08d12b4e74599705c6e88f36bda5f4ec712fe58d1286a159fcfa6

ip-160-153-244-20.ip.secureserver.net Open in urlscan Pro 160.153.244.20 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

5 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

4 IPs

1 Countries

197 kBTransfer

206 kBSize

0 Cookies

1 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

19 JavaScript Global Variables

0 Cookies

Indicators

ip-160-153-244-20.ip.secureserver.net Open in urlscan Pro
160.153.244.20 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

4
IPs

1
Countries

197 kB
Transfer

206 kB
Size

0
Cookies

5 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!