www.activity-transactcomm.com Open in urlscan Pro
2a02:4780:b:860:0:2200:fe87:1  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.activity-transactcomm.com/	18 KB 7 KB	443ms 144ms	Document text/html	2a02:4780:b:860:0:2200:fe87:1 AS-HOSTINGER
General Check archive.org Show headers Download Go to Full URL https://www.activity-transactcomm.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:4780:b:860:0:2200:fe87:1 , Cyprus, ASN47583 (AS-HOSTINGER, CY), Reverse DNS Software LiteSpeed / PHP/7.4.30 Resource Hash 9a021ab51f69272700c4f5f939a6ccb6ce01053cfbdc7ea5bea3b63e5a49720c Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" cache-control no-store, no-cache, must-revalidate content-encoding br content-length 7104 content-security-policy upgrade-insecure-requests content-type text/html; charset=UTF-8 date Sat, 27 Aug 2022 04:04:38 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server LiteSpeed vary Accept-Encoding x-powered-by PHP/7.4.30
GET H2	200	jquery.js Show response www.activity-transactcomm.com/files/	87 KB 29 KB	149ms 145ms	Script application/x-javascript	2a02:4780:b:860:0:2200:fe87:1 AS-HOSTINGER
General Check archive.org Show headers Download Go to Full URL https://www.activity-transactcomm.com/files/jquery.js Requested by Host: www.activity-transactcomm.com URL: https://www.activity-transactcomm.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:4780:b:860:0:2200:fe87:1 , Cyprus, ASN47583 (AS-HOSTINGER, CY), Reverse DNS Software LiteSpeed / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers accept-language de-DE,de;q=0.9 Referer https://www.activity-transactcomm.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Sat, 27 Aug 2022 04:04:38 GMT content-encoding br last-modified Sat, 27 Aug 2022 03:54:13 GMT server LiteSpeed etag "15d9d-63099565-69e7f7efd4c5421d;br" vary Accept-Encoding content-type application/x-javascript cache-control public, max-age=604800 content-security-policy upgrade-insecure-requests accept-ranges bytes content-length 30021 expires Sat, 03 Sep 2022 04:04:38 GMT
GET H2	200	logon-merge.8397238ab0ae7a25ea1af4d375f2c3df.css www.activity-transactcomm.com/files/	34 KB 7 KB	143ms 142ms	Stylesheet text/css	2a02:4780:b:860:0:2200:fe87:1 AS-HOSTINGER
General Check archive.org Show headers Download Go to Full URL https://www.activity-transactcomm.com/files/logon-merge.8397238ab0ae7a25ea1af4d375f2c3df.css Requested by Host: www.activity-transactcomm.com URL: https://www.activity-transactcomm.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:4780:b:860:0:2200:fe87:1 , Cyprus, ASN47583 (AS-HOSTINGER, CY), Reverse DNS Software LiteSpeed / Resource Hash 3c093420063c17dfc60e4400cbc0cdbdd90b98ffeb8e44406a4d776d32e55518 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers accept-language de-DE,de;q=0.9 Referer https://www.activity-transactcomm.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Sat, 27 Aug 2022 04:04:38 GMT content-encoding br last-modified Sat, 27 Aug 2022 03:54:13 GMT server LiteSpeed etag "891c-63099565-42aaad27f55f9754;br" vary Accept-Encoding content-type text/css cache-control public, max-age=604800 content-security-policy upgrade-insecure-requests accept-ranges bytes content-length 6735 expires Sat, 03 Sep 2022 04:04:38 GMT
GET H/1.1	200 OK	cba_mainlogo.ac9de6fb5214be84653367c74ba0b5f0.gif static.my.commbank.com.au/static/netbank/theme/fo/images/	5 KB 5 KB	150ms 12ms	Image image/gif	104.111.234.130 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://static.my.commbank.com.au/static/netbank/theme/fo/images/cba_mainlogo.ac9de6fb5214be84653367c74ba0b5f0.gif Requested by Host: www.activity-transactcomm.com URL: https://www.activity-transactcomm.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.234.130 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-234-130.deploy.static.akamaitechnologies.com Software / Resource Hash 4620bea7b8db9ffe1747e9c29910d7ea2ec84a7a3c7416e7a8a70e450073d820 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://www.activity-transactcomm.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers Date Sat, 27 Aug 2022 04:04:38 GMT Last-Modified Mon, 30 Aug 2021 05:19:28 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload Content-Type image/gif Access-Control-Allow-Origin * Cache-Control public,max-age=31536000,must-revalidate,proxy-revalidate Connection keep-alive Accept-Ranges bytes Content-Length 4852
GET H/1.1	200 OK	sustainability_hub_small.jpg static.my.commbank.com.au/static/cmxAssets/netbank-logon/	28 KB 28 KB	19ms 14ms	Image image/jpeg	104.111.234.130 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://static.my.commbank.com.au/static/cmxAssets/netbank-logon/sustainability_hub_small.jpg Requested by Host: www.activity-transactcomm.com URL: https://www.activity-transactcomm.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.234.130 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-234-130.deploy.static.akamaitechnologies.com Software / Resource Hash 92140e5b29ac1ee8a1e43bf8510307f270367676d9c8ba456f00a47831c9f7a5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://www.activity-transactcomm.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers Date Sat, 27 Aug 2022 04:04:38 GMT Last-Modified Tue, 10 Aug 2021 05:48:59 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload Content-Type image/jpeg Access-Control-Allow-Origin * Cache-Control public,max-age=31536000,must-revalidate,proxy-revalidate Connection keep-alive Accept-Ranges bytes Content-Length 28794
GET H/1.1	200 OK	commbankmobile.png static.my.commbank.com.au/static/cmxAssets/netbank-logon/	984 B 1 KB	12ms 12ms	Image image/png	104.111.234.130 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://static.my.commbank.com.au/static/cmxAssets/netbank-logon/commbankmobile.png Requested by Host: www.activity-transactcomm.com URL: https://www.activity-transactcomm.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.234.130 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-234-130.deploy.static.akamaitechnologies.com Software / Resource Hash cf17cf84b3f23f4e05641feb4c518f4a26e03ae5564c38ad035a66d7ab41bacd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://www.activity-transactcomm.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers Date Sat, 27 Aug 2022 04:04:38 GMT Last-Modified Tue, 12 May 2015 01:25:56 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload Content-Type image/png Access-Control-Allow-Origin * Cache-Control public,max-age=31536000,must-revalidate,proxy-revalidate Connection keep-alive Accept-Ranges bytes Content-Length 984
GET H3	200	hbg.0236e4e9a193069c4e8554db8b06354c.png www.activity-transactcomm.com/files/	254 B 561 B	143ms 143ms	Image image/png	2a02:4780:b:860:0:2200:fe87:1 AS-HOSTINGER
General Check archive.org Show headers Download Go to Show image Full URL https://www.activity-transactcomm.com/files/hbg.0236e4e9a193069c4e8554db8b06354c.png Requested by Host: www.activity-transactcomm.com URL: https://www.activity-transactcomm.com/files/logon-merge.8397238ab0ae7a25ea1af4d375f2c3df.css Protocol H3 Security QUIC, , AES_128_GCM Server 2a02:4780:b:860:0:2200:fe87:1 , Cyprus, ASN47583 (AS-HOSTINGER, CY), Reverse DNS Software LiteSpeed / Resource Hash f0755c4aa02ff90cf951d4752166ce52ea98cb85b86186f954dcc5d9d9cd02c0 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers accept-language de-DE,de;q=0.9 Referer https://www.activity-transactcomm.com/files/logon-merge.8397238ab0ae7a25ea1af4d375f2c3df.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Sat, 27 Aug 2022 04:04:38 GMT last-modified Sat, 27 Aug 2022 03:54:13 GMT server LiteSpeed etag "fe-63099565-e26fc2e0a74b2316;;;" content-type image/png cache-control public, max-age=604800 content-security-policy upgrade-insecure-requests accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 254 expires Sat, 03 Sep 2022 04:04:38 GMT
GET H3	200	logonsprite2.307a0c523f35f709f390895b4720d350.png www.activity-transactcomm.com/files/	14 KB 14 KB	142ms 142ms	Image image/png	2a02:4780:b:860:0:2200:fe87:1 AS-HOSTINGER
General Check archive.org Show headers Download Go to Show image Full URL https://www.activity-transactcomm.com/files/logonsprite2.307a0c523f35f709f390895b4720d350.png Requested by Host: www.activity-transactcomm.com URL: https://www.activity-transactcomm.com/files/logon-merge.8397238ab0ae7a25ea1af4d375f2c3df.css Protocol H3 Security QUIC, , AES_128_GCM Server 2a02:4780:b:860:0:2200:fe87:1 , Cyprus, ASN47583 (AS-HOSTINGER, CY), Reverse DNS Software LiteSpeed / Resource Hash c3787cbabd5c9acf9bfdc72c8e706754d644a14d5bd538e675c1885ccae87341 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers accept-language de-DE,de;q=0.9 Referer https://www.activity-transactcomm.com/files/logon-merge.8397238ab0ae7a25ea1af4d375f2c3df.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Sat, 27 Aug 2022 04:04:38 GMT last-modified Sat, 27 Aug 2022 03:54:13 GMT server LiteSpeed etag "377f-63099565-72e7d8a621a87fa1;;;" content-type image/png cache-control public, max-age=604800 content-security-policy upgrade-insecure-requests accept-ranges bytes content-length 14207 expires Sat, 03 Sep 2022 04:04:38 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Commonwealth Bank (Banking)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.activity-transactcomm.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 995de54ac3935945b6d448f29dd63eb5

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

static.my.commbank.com.au
www.activity-transactcomm.com
104.111.234.130
2a02:4780:b:860:0:2200:fe87:1
3c093420063c17dfc60e4400cbc0cdbdd90b98ffeb8e44406a4d776d32e55518
4620bea7b8db9ffe1747e9c29910d7ea2ec84a7a3c7416e7a8a70e450073d820
92140e5b29ac1ee8a1e43bf8510307f270367676d9c8ba456f00a47831c9f7a5
9a021ab51f69272700c4f5f939a6ccb6ce01053cfbdc7ea5bea3b63e5a49720c
c3787cbabd5c9acf9bfdc72c8e706754d644a14d5bd538e675c1885ccae87341
cf17cf84b3f23f4e05641feb4c518f4a26e03ae5564c38ad035a66d7ab41bacd
f0755c4aa02ff90cf951d4752166ce52ea98cb85b86186f954dcc5d9d9cd02c0
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e