lb.boq.com.au.payment-review.biz
Open in
urlscan Pro
204.11.59.40
Malicious Activity!
Public Scan
Effective URL: https://lb.boq.com.au.payment-review.biz/login/
Submission: On April 25 via manual from IN — Scanned from AU
Summary
TLS certificate: Issued by R3 on April 24th 2023. Valid for: 3 months.
This is the only time lb.boq.com.au.payment-review.biz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Bank of Queensland (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 16 | 204.11.59.40 204.11.59.40 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
2 | 69.16.175.42 69.16.175.42 | 20446 (STACKPATH...) (STACKPATH-CDN) | |
16 | 2 |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 204.11.59-40.publicdomainregistry.com
lb.boq.com.au.payment-review.biz |
Apex Domain Subdomains |
Transfer | |
---|---|---|
16 |
payment-review.biz
2 redirects
lb.boq.com.au.payment-review.biz |
169 KB |
2 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 997 |
96 KB |
16 | 2 |
Domain | Requested by | |
---|---|---|
16 | lb.boq.com.au.payment-review.biz |
2 redirects
lb.boq.com.au.payment-review.biz
|
2 | code.jquery.com |
lb.boq.com.au.payment-review.biz
|
16 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
lb.boq.com.au.payment-review.biz R3 |
2023-04-24 - 2023-07-23 |
3 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2022-08-03 - 2023-07-14 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://lb.boq.com.au.payment-review.biz/login/
Frame ID: C7F09F143C7EF3475092DA9ABCEA2845
Requests: 3 HTTP requests in this frame
Frame:
https://lb.boq.com.au.payment-review.biz/login/.site/
Frame ID: 461F9E95903E437CF7A29AF159F4D0EC
Requests: 13 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://lb.boq.com.au.payment-review.biz/
HTTP 302
https://lb.boq.com.au.payment-review.biz/login HTTP 301
https://lb.boq.com.au.payment-review.biz/login/ Page URL
Detected technologies
Vue.js (JavaScript Frameworks) ExpandDetected patterns
- <[^>]+\sdata-v(?:ue)?-
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jQuery UI (JavaScript Libraries) Expand
Detected patterns
- ([\d.]+)/jquery-ui(?:\.min)?\.js
- jquery-ui.*\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://lb.boq.com.au.payment-review.biz/
HTTP 302
https://lb.boq.com.au.payment-review.biz/login HTTP 301
https://lb.boq.com.au.payment-review.biz/login/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
lb.boq.com.au.payment-review.biz/login/ Redirect Chain
|
375 B 343 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.46f577a5.js
lb.boq.com.au.payment-review.biz/login/assets/ |
51 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.4ed2e5b5.css
lb.boq.com.au.payment-review.biz/login/assets/ |
91 B 141 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
lb.boq.com.au.payment-review.biz/login/.site/ Frame 461F |
16 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
default.css
lb.boq.com.au.payment-review.biz/login/.site/index_files/ Frame 461F |
112 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
site_logo.gif
lb.boq.com.au.payment-review.biz/login/.site/index_files/ Frame 461F |
3 KB 3 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
site_logo_print.gif
lb.boq.com.au.payment-review.biz/login/.site/index_files/ Frame 461F |
3 KB 3 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
banner.jpg
lb.boq.com.au.payment-review.biz/login/.site/index_files/ Frame 461F |
6 KB 6 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
powered-by_005.gif
lb.boq.com.au.payment-review.biz/login/.site/index_files/ Frame 461F |
580 B 610 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
powered_by_PRINT.gif
lb.boq.com.au.payment-review.biz/login/.site/index_files/ Frame 461F |
540 B 570 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.4.1.min.js
code.jquery.com/ Frame 461F |
86 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-ui.min.js
code.jquery.com/ui/1.12.1/ Frame 461F |
248 KB 66 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
print.css
lb.boq.com.au.payment-review.biz/login/.site/index_files/ Frame 461F |
11 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Arrows-TextureStrip.png
lb.boq.com.au.payment-review.biz/login/.site/index_files/images/ Frame 461F |
18 KB 18 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
boqlogo-resized.png
lb.boq.com.au.payment-review.biz/login/.site/index_files/images/ Frame 461F |
30 KB 30 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
toolbar-icons.png
lb.boq.com.au.payment-review.biz/login/.site/index_files/images/_icons/ Frame 461F |
51 KB 52 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Bank of Queensland (Banking)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 boolean| credentialless boolean| __VUE__0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
lb.boq.com.au.payment-review.biz
204.11.59.40
69.16.175.42
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
317b544b658a65974f28bf85a4cfcaec238822d9339559ba2fe7048b1d1e9f57
320256c517eb8be18537b5e3ea38d6994a59a0ceaf33c0525b4b0db2e0fe6e69
4ed2e5b564d1ffb3d9d599f8158220600efb389d3fcc4839ee6520f105f3cff9
55accff7b642c2d7a402cbe03c1494c0f14a76bc03dee9d47d219562b6a152a5
58888d38ddae820dd26c7061ca62925a5ace1f4562158d7a255ba3c00df42727
5ade06dbef1c0d0557dee69d5308d95e2e8d27abf850b4c963c92b732eb37d24
5bd55d688ad4963d7894569217b62ffe8ae1c11f34646e4fa84899a8d719fd7f
5f87830763a90b75b02123bd5a3cf6e17b21cd08c6b25b3e9858e17ffeb24901
79ab27da427e93271ebcdb8f79707ab815436264e558865b1bfff0176000c795
8b74cf562f0044527cbb55273b8c4fb1facabaa2d73ed92bc2ff67babd2b403e
8d2318bb5f57657c72e70a91109ac9401ee57d58dc528835744b35fe31e0659d
b43fc442b885d04c0074ee02f4a11a0cae4a34fd21dca632211a61effc073fd6
dd115d1d61161efee28ad56336dfa62e07d516c6d06fdcc13b6514efd21386df
e6c0a008d679782c3da0509d27940214e5681690a738d9ffe51804f993b47a20
ec0a7562f3c71d317c48a338cf7c9824228d6cabc789bfd7becc55d3a0ba0884