59949c760470474f995b7a1b0dd41a5a.yatu.ws Open in urlscan Pro
2001:4b99:1:253::8 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://59949c760470474f995b7a1b0dd41a5a.yatu.ws/personal/personal/
Effective URL:
http://59949c760470474f995b7a1b0dd41a5a.yatu.ws/personal/personal/customer_center/customer_Case=IDPP00C286/myaccount/personal/personal-login.php...
Submission: On June 09 via manual (June 9th 2019, 11:16:15 pm UTC) from US

Summary HTTP 12 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 12 HTTP transactions. The main IP is 2001:4b99:1:253::8, located in France and belongs to GANDI-AS-2 Domain name registrar - http://www.gandi.net, FR. The main domain is 59949c760470474f995b7a1b0dd41a5a.yatu.ws.

This is the only time 59949c760470474f995b7a1b0dd41a5a.yatu.ws was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BNZ Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
4 7	2001:4b99:1:2... 2001:4b99:1:253::8	203476 (GANDI-AS-...) (GANDI-AS-2 Domain name registrar - http://www.gandi.net)
4	52.201.107.186 52.201.107.186	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
5	45.60.78.175 45.60.78.175	19551 (INCAPSULA) (INCAPSULA - Incapsula Inc)
12	3

7 2001:4b99:1:253::8 (France) 4 redirects

ASN203476 (GANDI-AS-2 Domain name registrar - http://www.gandi.net, FR)

59949c760470474f995b7a1b0dd41a5a.yatu.ws	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.201.107.186 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-201-107-186.compute-1.amazonaws.com

execution-use.ci360.sas.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 45.60.78.175 (United States)

ASN19551 (INCAPSULA - Incapsula Inc, US)

www.bnz.co.nz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
m.bnz.co.nz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	yatu.ws 4 redirects 59949c760470474f995b7a1b0dd41a5a.yatu.ws	10 KB
5	bnz.co.nz www.bnz.co.nz m.bnz.co.nz	42 KB
4	sas.com execution-use.ci360.sas.com	74 KB
12	3

	Domain	Requested by
7	59949c760470474f995b7a1b0dd41a5a.yatu.ws	4 redirects 59949c760470474f995b7a1b0dd41a5a.yatu.ws
4	www.bnz.co.nz	59949c760470474f995b7a1b0dd41a5a.yatu.ws
4	execution-use.ci360.sas.com	59949c760470474f995b7a1b0dd41a5a.yatu.ws
1	m.bnz.co.nz	59949c760470474f995b7a1b0dd41a5a.yatu.ws
12	4

This site contains links to these domains. Also see Links.

Domain
www.bnz.co.nz

Subject Issuer	Validity	Valid
*.ci360.sas.com DigiCert SHA2 Secure Server CA	`2019-04-23` - `2021-07-22`	2 years	crt.sh
www.bnz.co.nz Entrust Certification Authority - L1M	`2019-04-11` - `2020-05-05`	a year	crt.sh
	`1970-01-01` - `1970-01-01`	a few seconds	crt.sh

This page contains 1 frames:

Primary Page: http://59949c760470474f995b7a1b0dd41a5a.yatu.ws/personal/personal/customer_center/customer_Case=IDPP00C286/myaccount/personal/personal-login.php?enc=16cd15d5ab82c1d54cec025b138cac91&p=0&dispatch=2552b5811914c37c79281266572bb7a22ec248c0
Frame ID: 07A9DA327152E750AC8D16C748675E0F
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://59949c760470474f995b7a1b0dd41a5a.yatu.ws/personal/personal/ HTTP 302
http://59949c760470474f995b7a1b0dd41a5a.yatu.ws/personal/personal/customer_center/customer_Case=IDPP00C286 HTTP 301
http://59949c760470474f995b7a1b0dd41a5a.yatu.ws/personal/personal/customer_center/customer_Case=IDPP00C286/ HTTP 302
http://59949c760470474f995b7a1b0dd41a5a.yatu.ws/personal/personal/customer_center/customer_Case=IDPP00C286/myaccount/persona... HTTP 302
http://59949c760470474f995b7a1b0dd41a5a.yatu.ws/personal/personal/customer_center/customer_Case=IDPP00C286/myaccount/persona... Page URL

Detected technologies

Varnish (Cache Tools) Expand

Overall confidence: 100%
Detected patterns

headers via /.*Varnish/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

12
Requests

75 %
HTTPS

33 %
IPv6

3
Domains

4
Subdomains

3
IPs

2
Countries

125 kB
Transfer

368 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.bnz.co.nz/
Title:

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://59949c760470474f995b7a1b0dd41a5a.yatu.ws/personal/personal/ HTTP 302
http://59949c760470474f995b7a1b0dd41a5a.yatu.ws/personal/personal/customer_center/customer_Case=IDPP00C286 HTTP 301
http://59949c760470474f995b7a1b0dd41a5a.yatu.ws/personal/personal/customer_center/customer_Case=IDPP00C286/ HTTP 302
http://59949c760470474f995b7a1b0dd41a5a.yatu.ws/personal/personal/customer_center/customer_Case=IDPP00C286/myaccount/personal/?country.x=DE&locale.x=en_DE HTTP 302
http://59949c760470474f995b7a1b0dd41a5a.yatu.ws/personal/personal/customer_center/customer_Case=IDPP00C286/myaccount/personal/personal-login.php?enc=16cd15d5ab82c1d54cec025b138cac91&p=0&dispatch=2552b5811914c37c79281266572bb7a22ec248c0 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request personal-login.php Show response
59949c760470474f995b7a1b0dd41a5a.yatu.ws/personal/personal/customer_center/customer_Case=IDPP00C286/myaccount/personal/
Redirect Chain

http://59949c760470474f995b7a1b0dd41a5a.yatu.ws/personal/personal/
http://59949c760470474f995b7a1b0dd41a5a.yatu.ws/personal/personal/customer_center/customer_Case=IDPP00C286
http://59949c760470474f995b7a1b0dd41a5a.yatu.ws/personal/personal/customer_center/customer_Case=IDPP00C286/
http://59949c760470474f995b7a1b0dd41a5a.yatu.ws/personal/personal/customer_center/customer_Case=IDPP00C286/myaccount/personal/?country.x=DE&locale.x=en_DE
http://59949c760470474f995b7a1b0dd41a5a.yatu.ws/personal/personal/customer_center/customer_Case=IDPP00C286/myaccount/personal/personal-login.php?enc=16cd15d5ab82c1d54cec025b138cac91&p=0&dispatch=25...

54 KB
8 KB

196ms
195ms

Document
text/html

2001:4b99:1:253::8
http://www.gandi.net

General

Check archive.org

Show headers Download Go to

Full URL: http://59949c760470474f995b7a1b0dd41a5a.yatu.ws/personal/personal/customer_center/customer_Case=IDPP00C286/myaccount/personal/personal-login.php?enc=16cd15d5ab82c1d54cec025b138cac91&p=0&dispatch=2552b5811914c37c79281266572bb7a22ec248c0
Protocol: HTTP/1.1
Server: 2001:4b99:1:253::8 , France, ASN203476 (GANDI-AS-2 Domain name registrar - http://www.gandi.net, FR),
Reverse DNS
Software: Apache / PHP/7.3.0
Resource Hash: 9bfad4e65ce5a711d78f0851aeb1637a390dac11dbb6589c6bd410c91fb6a175

Request headers

Host: 59949c760470474f995b7a1b0dd41a5a.yatu.ws
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=7jhq99a2ospav3ojkmidujraqu
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sun, 09 Jun 2019 23:15:58 GMT
Server: Apache
X-Powered-By: PHP/7.3.0
Content-Encoding: gzip
Content-Length: 8341
Content-Type: text/html; charset=UTF-8
Via: 1.1 varnish (Varnish/6.2), 1.1 varnish (Varnish/6.2)
Vary: Accept-Encoding
X-Cache-Hits: 0
X-Cache: MISS
Accept-Ranges: bytes
Age: 0
Connection: keep-alive

Redirect headers

Date: Sun, 09 Jun 2019 23:15:57 GMT
Server: Apache
X-Powered-By: PHP/7.3.0
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Location: personal-login.php?enc=16cd15d5ab82c1d54cec025b138cac91&p=0&dispatch=2552b5811914c37c79281266572bb7a22ec248c0
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Via: 1.1 varnish (Varnish/6.2), 1.1 varnish (Varnish/6.2)
X-Cache-Hits: 0
X-Cache: MISS
Age: 0
Connection: keep-alive

GET
H/1.1 200
OK ot-min.js Show response
execution-use.ci360.sas.com/js/ 226 KB
62 KB 502ms
192ms Script
application/javascript 52.201.107.186
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://execution-use.ci360.sas.com/js/ot-min.js
Requested by: Host: 59949c760470474f995b7a1b0dd41a5a.yatu.ws
URL: http://59949c760470474f995b7a1b0dd41a5a.yatu.ws/personal/personal/customer_center/customer_Case=IDPP00C286/myaccount/personal/personal-login.php?enc=16cd15d5ab82c1d54cec025b138cac91&p=0&dispatch=2552b5811914c37c79281266572bb7a22ec248c0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.201.107.186 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-201-107-186.compute-1.amazonaws.com
Software: /
Resource Hash: 94c1d2781f3be8743a37600af06bc9426848c70c246b9e70cc55dc7c5022e507

Request headers

Referer: http://59949c760470474f995b7a1b0dd41a5a.yatu.ws/personal/personal/customer_center/customer_Case=IDPP00C286/myaccount/personal/personal-login.php?enc=16cd15d5ab82c1d54cec025b138cac91&p=0&dispatch=2552b5811914c37c79281266572bb7a22ec248c0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sun, 09 Jun 2019 23:15:58 GMT
Content-Encoding: gzip
Last-Modified: Thu, 06 Jun 2019 09:30:00 GMT
ETag: W/"230936-1559813400000"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=1800, no-cache="set-cookie"
transfer-encoding: chunked
Connection: keep-alive
Accept-Ranges: bytes
Expires: Sun, 09 Jun 2019 23:45:58 GMT

GET
H/1.1 200
OK 1541300958852 Show response
execution-use.ci360.sas.com/t/s/c/c0b52ff90d000139628464bd/ 36 KB
7 KB 410ms
98ms Script
application/javascript 52.201.107.186
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://execution-use.ci360.sas.com/t/s/c/c0b52ff90d000139628464bd/1541300958852?version=1.1.0&domain=secure.bnz.co.nz&vid=602a09e69517005717d1d194&sid=a340445c05b821386a511685&hb=1603461&p=%2Fauth%2Fpersonal-login&params=&page_title=BNZ%20Login&referrer=https%3A%2F%2Fwww.bnz.co.nz%2F&uri=https%3A%2F%2Fsecure.bnz.co.nz%2Fauth%2Fpersonal-login&requestedfile=%2Fauth%2Fpersonal-login&cts=1541300958852&tzo=-780&platform=Win32&port=&protocol=https&flash_enabled=false&flash_version=&java_enabled=false&java_version=&screen_info=465x531@24&browser_language=en-NZ&character_set=UTF-8&csz=36689&bsz=465x531&tab_id=326044853838
Requested by: Host: 59949c760470474f995b7a1b0dd41a5a.yatu.ws
URL: http://59949c760470474f995b7a1b0dd41a5a.yatu.ws/personal/personal/customer_center/customer_Case=IDPP00C286/myaccount/personal/personal-login.php?enc=16cd15d5ab82c1d54cec025b138cac91&p=0&dispatch=2552b5811914c37c79281266572bb7a22ec248c0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.201.107.186 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-201-107-186.compute-1.amazonaws.com
Software: /
Resource Hash: b4a01d5bc3a45f4864ae7819b4741b0856626cdd54c0c96f5391567efacf3dd4

Request headers

Referer: http://59949c760470474f995b7a1b0dd41a5a.yatu.ws/personal/personal/customer_center/customer_Case=IDPP00C286/myaccount/personal/personal-login.php?enc=16cd15d5ab82c1d54cec025b138cac91&p=0&dispatch=2552b5811914c37c79281266572bb7a22ec248c0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sun, 09 Jun 2019 23:15:58 GMT
Content-Encoding: gzip
transfer-encoding: chunked
Cache-Control: no-cache, no-cache="set-cookie"
Vary: Accept-Encoding
Connection: keep-alive
Content-Type: application/javascript;charset=UTF-8

GET
H/1.1 200
OK c0b52ff90d000139628464bd Show response
execution-use.ci360.sas.com/t/s/p/ 87 B
472 B 436ms
102ms Script
application/javascript 52.201.107.186
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://execution-use.ci360.sas.com/t/s/p/c0b52ff90d000139628464bd?version=1.1.0&domain=secure.bnz.co.nz&p=%2Fauth%2Fpersonal-login&params=&page_title=BNZ%20Login&referrer=https%3A%2F%2Fwww.bnz.co.nz%2F&uri=https%3A%2F%2Fsecure.bnz.co.nz%2Fauth%2Fpersonal-login&requestedfile=%2Fauth%2Fpersonal-login&platform=Win32&port=&protocol=https&browser_language=en-NZ&character_set=UTF-8
Requested by: Host: 59949c760470474f995b7a1b0dd41a5a.yatu.ws
URL: http://59949c760470474f995b7a1b0dd41a5a.yatu.ws/personal/personal/customer_center/customer_Case=IDPP00C286/myaccount/personal/personal-login.php?enc=16cd15d5ab82c1d54cec025b138cac91&p=0&dispatch=2552b5811914c37c79281266572bb7a22ec248c0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.201.107.186 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-201-107-186.compute-1.amazonaws.com
Software: /
Resource Hash: 01e02a02093340071d1364f08f71d9f2c62e272ba902bbc4a01bc505f693fc1e

Request headers

Referer: http://59949c760470474f995b7a1b0dd41a5a.yatu.ws/personal/personal/customer_center/customer_Case=IDPP00C286/myaccount/personal/personal-login.php?enc=16cd15d5ab82c1d54cec025b138cac91&p=0&dispatch=2552b5811914c37c79281266572bb7a22ec248c0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sun, 09 Jun 2019 23:15:58 GMT
Cache-Control: max-age=1800, no-cache="set-cookie"
Connection: keep-alive
Content-Length: 87
Content-Type: application/javascript;charset=UTF-8

GET
H2 200 serrano.css
www.bnz.co.nz/serrano/ 2 KB
898 B 400ms
10ms Stylesheet
text/css 45.60.78.175
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bnz.co.nz/serrano/serrano.css

Requested by

Host: 59949c760470474f995b7a1b0dd41a5a.yatu.ws
URL: http://59949c760470474f995b7a1b0dd41a5a.yatu.ws/personal/personal/customer_center/customer_Case=IDPP00C286/myaccount/personal/personal-login.php?enc=16cd15d5ab82c1d54cec025b138cac91&p=0&dispatch=2552b5811914c37c79281266572bb7a22ec248c0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.78.175 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

Software

Resource Hash

f8260d7d44cfb1f8029f9a65067d76476106c2dbf95aab7673a51198ca6b9659

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: http://59949c760470474f995b7a1b0dd41a5a.yatu.ws/personal/personal/customer_center/customer_Case=IDPP00C286/myaccount/personal/personal-login.php?enc=16cd15d5ab82c1d54cec025b138cac91&p=0&dispatch=2552b5811914c37c79281266572bb7a22ec248c0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 09 Jun 2019 23:15:57 GMT
content-encoding: gzip
last-modified: Mon, 18 Mar 2019 22:34:12 GMT
x-cdn: Incapsula
etag: "976-gzip"
strict-transport-security: max-age=31536000
content-type: text/css
status: 200
x-iinfo: 11-37448892-0 0CNN RT(1560122157954 0) q(0 -1 -1 0) r(0 -1)
cache-control: max-age=601184, public
content-length: 472
expires: Sun, 16 Jun 2019 22:15:41 GMT

GET
H2 200 logout.png
m.bnz.co.nz/pa/oidc/ 70 B
576 B 1854ms
1463ms Image
image/png 45.60.78.175
Incapsula Inc

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://m.bnz.co.nz/pa/oidc/logout.png?125.8794931688417

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.78.175 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

Software

Resource Hash

dc5687b50f70cb95379bfced5a0eae768dd4382cd6b393ee77d65bbdd6373fbf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	DENY

Request headers

Referer: http://59949c760470474f995b7a1b0dd41a5a.yatu.ws/personal/personal/customer_center/customer_Case=IDPP00C286/myaccount/personal/personal-login.php?enc=16cd15d5ab82c1d54cec025b138cac91&p=0&dispatch=2552b5811914c37c79281266572bb7a22ec248c0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
x-cdn: Incapsula
x-frame-options: DENY
p3p: CP="CAO PSA OUR"
status: 200
x-iinfo: 11-37448894-37448896 NNNN CT(281 886 0) RT(1560122157957 0) q(0 0 12 1) r(15 15) U2
cache-control: private,no-cache,no-store
content-type: image/png
content-length: 70
expires: 0

GET
H2 200 logout.png
www.bnz.co.nz/pa/oidc/ 70 B
651 B 694ms
304ms Image
image/png 45.60.78.175
Incapsula Inc

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bnz.co.nz/pa/oidc/logout.png?790.5449515028782

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.78.175 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

Software

Resource Hash

dc5687b50f70cb95379bfced5a0eae768dd4382cd6b393ee77d65bbdd6373fbf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	DENY

Request headers

Referer: http://59949c760470474f995b7a1b0dd41a5a.yatu.ws/personal/personal/customer_center/customer_Case=IDPP00C286/myaccount/personal/personal-login.php?enc=16cd15d5ab82c1d54cec025b138cac91&p=0&dispatch=2552b5811914c37c79281266572bb7a22ec248c0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
x-cdn: Incapsula
x-frame-options: DENY
p3p: CP="CAO PSA OUR"
status: 200
x-iinfo: 11-37448893-37448895 NNNN CT(0 0 0) RT(1560122157955 0) q(0 0 0 2) r(3 3) U2
cache-control: private,no-cache,no-store
content-type: image/png
content-length: 70
expires: 0

GET
H/1.1 200
OK c0b52ff90d000139628464bd Show response
execution-use.ci360.sas.com/t/s/s/ 11 KB
5 KB 460ms
109ms Script
application/javascript 52.201.107.186
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://execution-use.ci360.sas.com/t/s/s/c0b52ff90d000139628464bd
Requested by: Host: 59949c760470474f995b7a1b0dd41a5a.yatu.ws
URL: http://59949c760470474f995b7a1b0dd41a5a.yatu.ws/personal/personal/customer_center/customer_Case=IDPP00C286/myaccount/personal/personal-login.php?enc=16cd15d5ab82c1d54cec025b138cac91&p=0&dispatch=2552b5811914c37c79281266572bb7a22ec248c0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.201.107.186 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-201-107-186.compute-1.amazonaws.com
Software: /
Resource Hash: 5876959468cc366fe93ba61643622fdd917f01a2aa1e2b53ff4ced66facbbc32

Request headers

Referer: http://59949c760470474f995b7a1b0dd41a5a.yatu.ws/personal/personal/customer_center/customer_Case=IDPP00C286/myaccount/personal/personal-login.php?enc=16cd15d5ab82c1d54cec025b138cac91&p=0&dispatch=2552b5811914c37c79281266572bb7a22ec248c0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sun, 09 Jun 2019 23:15:58 GMT
Content-Encoding: gzip
Cache-control: no-cache="set-cookie"
Content-Length: 4680
Vary: Accept-Encoding
Connection: keep-alive
Content-Type: application/javascript;charset=ISO-8859-1

GET
H/1.1 404
Not Found main.a88c18e8.js
59949c760470474f995b7a1b0dd41a5a.yatu.ws/auth/static/js/ 0
0 76ms
75ms Script
text/html 2001:4b99:1:253::8
http://www.gandi.net

General

Check archive.org

Show headers Download Go to

Full URL: http://59949c760470474f995b7a1b0dd41a5a.yatu.ws/auth/static/js/main.a88c18e8.js
Requested by: Host: 59949c760470474f995b7a1b0dd41a5a.yatu.ws
URL: http://59949c760470474f995b7a1b0dd41a5a.yatu.ws/personal/personal/customer_center/customer_Case=IDPP00C286/myaccount/personal/personal-login.php?enc=16cd15d5ab82c1d54cec025b138cac91&p=0&dispatch=2552b5811914c37c79281266572bb7a22ec248c0
Protocol: HTTP/1.1
Security: , ,
Server: 2001:4b99:1:253::8 , France, ASN203476 (GANDI-AS-2 Domain name registrar - http://www.gandi.net, FR),
Reverse DNS
Software: Apache / PHP/7.3.0
Resource Hash

Request headers

Referer: http://59949c760470474f995b7a1b0dd41a5a.yatu.ws/personal/personal/customer_center/customer_Case=IDPP00C286/myaccount/personal/personal-login.php?enc=16cd15d5ab82c1d54cec025b138cac91&p=0&dispatch=2552b5811914c37c79281266572bb7a22ec248c0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sun, 09 Jun 2019 23:15:58 GMT
Via: 1.1 varnish (Varnish/6.2), 1.1 varnish (Varnish/6.2)
Server: Apache
Age: 0
X-Powered-By: PHP/7.3.0
Transfer-Encoding: chunked
X-Cache: MISS
Content-Type: text/html; charset=UTF-8
Cache-Control: no-cache, must-revalidate, max-age=0
X-Cache-Hits: 0
Connection: keep-alive
Link: <http://59949c760470474f995b7a1b0dd41a5a.yatu.ws/wp-json/>; rel="https://api.w.org/"
Expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H/1.1 404
Not Found main.a88c18e8.js
59949c760470474f995b7a1b0dd41a5a.yatu.ws/auth/static/js/ 0
0 65ms
64ms Script
text/html 2001:4b99:1:253::8
http://www.gandi.net

General

Check archive.org

Show headers Download Go to

Full URL: http://59949c760470474f995b7a1b0dd41a5a.yatu.ws/auth/static/js/main.a88c18e8.js
Requested by: Host: 59949c760470474f995b7a1b0dd41a5a.yatu.ws
URL: http://59949c760470474f995b7a1b0dd41a5a.yatu.ws/personal/personal/customer_center/customer_Case=IDPP00C286/myaccount/personal/personal-login.php?enc=16cd15d5ab82c1d54cec025b138cac91&p=0&dispatch=2552b5811914c37c79281266572bb7a22ec248c0
Protocol: HTTP/1.1
Security: , ,
Server: 2001:4b99:1:253::8 , France, ASN203476 (GANDI-AS-2 Domain name registrar - http://www.gandi.net, FR),
Reverse DNS
Software: Apache / PHP/7.3.0
Resource Hash

Request headers

Referer: http://59949c760470474f995b7a1b0dd41a5a.yatu.ws/personal/personal/customer_center/customer_Case=IDPP00C286/myaccount/personal/personal-login.php?enc=16cd15d5ab82c1d54cec025b138cac91&p=0&dispatch=2552b5811914c37c79281266572bb7a22ec248c0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sun, 09 Jun 2019 23:15:58 GMT
Via: 1.1 varnish (Varnish/6.2), 1.1 varnish (Varnish/6.2)
Server: Apache
Age: 0
X-Powered-By: PHP/7.3.0
Transfer-Encoding: chunked
X-Cache: MISS
Content-Type: text/html; charset=UTF-8
Cache-Control: no-cache, must-revalidate, max-age=0
X-Cache-Hits: 0
Connection: keep-alive
Link: <http://59949c760470474f995b7a1b0dd41a5a.yatu.ws/wp-json/>; rel="https://api.w.org/"
Expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 200 SerranoWeb-Bold.woff2
www.bnz.co.nz/serrano/fonts/ 21 KB
21 KB 47ms
9ms Font
application/font-woff2 45.60.78.175
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bnz.co.nz/serrano/fonts/SerranoWeb-Bold.woff2?v=1c25c2c065

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.78.175 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

Software

Resource Hash

00597164b7643a1a0040f59fe7167231ba550754b16f0c7df456d7490698ba11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bnz.co.nz/serrano/serrano.css
Origin: http://59949c760470474f995b7a1b0dd41a5a.yatu.ws

Response headers

date: Sun, 09 Jun 2019 23:15:58 GMT
last-modified: Mon, 18 Mar 2019 22:34:12 GMT
x-cdn: Incapsula
access-control-allow-origin: *
etag: "5234"
strict-transport-security: max-age=31536000
content-type: application/font-woff2
status: 200
x-iinfo: 1-13846681-0 0CNN RT(1560122158012 0) q(0 -1 -1 0) r(0 -1)
cache-control: max-age=24879442, public
content-length: 21044
expires: Mon, 23 Mar 2020 22:13:20 GMT

GET
H2 200 SerranoWeb-Regular.woff2
www.bnz.co.nz/serrano/fonts/ 19 KB
19 KB 56ms
19ms Font
application/font-woff2 45.60.78.175
Incapsula Inc

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bnz.co.nz/serrano/fonts/SerranoWeb-Regular.woff2?v=5b6826770c

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.78.175 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

Software

Resource Hash

9e63cdc77de3df5b0b0685849e03d263716a22ccf56e4ed74807504dc227221c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bnz.co.nz/serrano/serrano.css
Origin: http://59949c760470474f995b7a1b0dd41a5a.yatu.ws

Response headers

date: Sun, 09 Jun 2019 23:15:58 GMT
last-modified: Mon, 18 Mar 2019 22:34:12 GMT
x-cdn: Incapsula
access-control-allow-origin: *
etag: "4b2c"
strict-transport-security: max-age=31536000
content-type: application/font-woff2
status: 200
x-iinfo: 1-13846682-0 0CNN RT(1560122158012 0) q(0 -1 -1 2) r(0 -1)
cache-control: max-age=24879442, public
content-length: 19244
expires: Mon, 23 Mar 2020 22:13:20 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BNZ Bank (Banking)

27 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

59949c760470474f995b7a1b0dd41a5a.yatu.ws
execution-use.ci360.sas.com
m.bnz.co.nz
www.bnz.co.nz
2001:4b99:1:253::8
45.60.78.175
52.201.107.186
00597164b7643a1a0040f59fe7167231ba550754b16f0c7df456d7490698ba11
01e02a02093340071d1364f08f71d9f2c62e272ba902bbc4a01bc505f693fc1e
5876959468cc366fe93ba61643622fdd917f01a2aa1e2b53ff4ced66facbbc32
94c1d2781f3be8743a37600af06bc9426848c70c246b9e70cc55dc7c5022e507
9bfad4e65ce5a711d78f0851aeb1637a390dac11dbb6589c6bd410c91fb6a175
9e63cdc77de3df5b0b0685849e03d263716a22ccf56e4ed74807504dc227221c
b4a01d5bc3a45f4864ae7819b4741b0856626cdd54c0c96f5391567efacf3dd4
dc5687b50f70cb95379bfced5a0eae768dd4382cd6b393ee77d65bbdd6373fbf
f8260d7d44cfb1f8029f9a65067d76476106c2dbf95aab7673a51198ca6b9659

59949c760470474f995b7a1b0dd41a5a.yatu.ws Open in urlscan Pro 2001:4b99:1:253::8 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

75 %HTTPS

33 %IPv6

3 Domains

4 Subdomains

3 IPs

2 Countries

125 kBTransfer

368 kBSize

0 Cookies

1 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

27 JavaScript Global Variables

0 Cookies

Indicators

59949c760470474f995b7a1b0dd41a5a.yatu.ws Open in urlscan Pro
2001:4b99:1:253::8 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

75 %
HTTPS

33 %
IPv6

3
Domains

4
Subdomains

3
IPs

2
Countries

125 kB
Transfer

368 kB
Size

0
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!