inland-revenue.line.pm Open in urlscan Pro
194.55.224.100 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.gvt-returns.live/
Effective URL:
https://inland-revenue.line.pm/ret/govtRebate
Submission: On March 21 via manual (March 21st 2023, 5:55:27 am UTC) from AU — Scanned from NZ

Summary HTTP 2 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 2 HTTP transactions. The main IP is 194.55.224.100, located in United States and belongs to AS_DELIS, US. The main domain is inland-revenue.line.pm.
TLS certificate: Issued by R3 on March 20th 2023. Valid for: 3 months.

This is the only time inland-revenue.line.pm was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: ASB Bank (Banking) NZ Government (Government)

Domain & IP information

	IP Address	AS Autonomous System
1 1	192.64.119.167 192.64.119.167	22612 (NAMECHEAP...) (NAMECHEAP-NET)
2	194.55.224.100 194.55.224.100	211252 (AS_DELIS) (AS_DELIS)
2	2

1 192.64.119.167 (United States) 1 redirects

ASN22612 (NAMECHEAP-NET, US)

www.gvt-returns.live	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 194.55.224.100 (United States)

ASN211252 (AS_DELIS, US)

inland-revenue.line.pm	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	line.pm inland-revenue.line.pm	469 KB
1	gvt-returns.live 1 redirects www.gvt-returns.live	261 B
2	2

	Domain	Requested by
2	inland-revenue.line.pm	inland-revenue.line.pm
1	www.gvt-returns.live	1 redirects
2	2

This site contains no links.

Subject Issuer	Validity	Valid
inland-revenue.line.pm R3	`2023-03-20` - `2023-06-18`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://inland-revenue.line.pm/ret/govtRebate
Frame ID: 57AAD0370FD9266814E781157E9974E2
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://www.gvt-returns.live/ HTTP 302
https://inland-revenue.line.pm/ret/govtRebate Page URL

Page Statistics

2
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

522 kB
Transfer

1352 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.gvt-returns.live/ HTTP 302
https://inland-revenue.line.pm/ret/govtRebate Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions
12 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request govtRebate Show response inland-revenue.line.pm/ret/ Redirect Chain http://www.gvt-returns.live/ https://inland-revenue.line.pm/ret/govtRebate	894 KB 469 KB	6321ms 5525ms	Document text/html	194.55.224.100 AS_DELIS
General Check archive.org Show headers Download Go to Full URL https://inland-revenue.line.pm/ret/govtRebate Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 194.55.224.100 , United States, ASN211252 (AS_DELIS, US), Reverse DNS Software Apache/2.4.29 (Ubuntu) / Resource Hash `7d0ffca8917b703cd62190ea344dc9a250493abce6b23a88d479d693d14c434a` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 accept-language en-NZ,en;q=0.9 Response headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Tue, 21 Mar 2023 05:55:14 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=100 Pragma no-cache Server Apache/2.4.29 (Ubuntu) Transfer-Encoding chunked Vary Accept-Encoding Redirect headers Connection keep-alive Content-Length 68 Content-Type text/html; charset=utf-8 Date Tue, 21 Mar 2023 05:55:12 GMT Location https://inland-revenue.line.pm/ret/govtRebate Server namecheap-nginx X-Served-By Namecheap URL Forward
GET DATA	200 OK	truncated /	178 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `5b69a0f8a317419ba7f30a64a6cf97223a2544399eb41717f00410baa2ef4c49` Request headers accept-language en-NZ,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	32 KB 32 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `282da86e1071d060a343341b75391a036a23e28adfc93e879fae9775e45bfd7d` Request headers Referer Origin https://inland-revenue.line.pm accept-language en-NZ,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Content-Type font/woff2
GET DATA	200 OK	truncated /	11 KB 11 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `586d66aa444adb25f168e3a20649d8f31a4459f9ec19f796d8cc131e46768cfe` Request headers Referer Origin https://inland-revenue.line.pm accept-language en-NZ,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Content-Type font/woff2
GET DATA	200 OK	truncated /	11 KB 11 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `7bdafffc801054b76371feb4e9d6905b34018d26680e2db4ec2b75bf0f3516d9` Request headers Referer Origin https://inland-revenue.line.pm accept-language en-NZ,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Content-Type font/woff2
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `7f0ed5425601a8d17185da1e481efdb42da4bc6b518c0b0096089f4acb27b068` Request headers accept-language en-NZ,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `9b43b7eb2389af34de87dd534aa3ef80c65614d3a9c26d1945f8f4373f78c554` Request headers accept-language en-NZ,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	31 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `c03c263c23f5bcc25de2f3216d324cb389f5c1b8543bb52b1e7f0ed483e81928` Request headers accept-language en-NZ,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	99 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `20cfe915c43e2028d600e21c95447fd6fd118acfd3436bf98404d72c45c89f62` Request headers accept-language en-NZ,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	5 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `7dc95d128d0424e708f1156a4875a066335d7b0c9faf7e046f1316b6bb44f4a5` Request headers accept-language en-NZ,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	20 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `f7e29046227820828dca701eb525a37bd7325a33d1c1e9c4dee3a233a18baa05` Request headers accept-language en-NZ,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `91357ecc89f3a91b7df932f64c9348c2a43443c23c3ce3b10e889b4228bc3a98` Request headers accept-language en-NZ,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	59 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `eda9fb07e8c3fd7c6476407801c2861c937dea801625a140d5c3f8f1e8bbcdd4` Request headers accept-language en-NZ,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Content-Type image/png
POST H/1.1	200 OK	online inland-revenue.line.pm/user/	0 0	794ms 794ms	Fetch text/html	194.55.224.100 AS_DELIS
General Check archive.org Show headers Download Go to Full URL https://inland-revenue.line.pm/user/online Requested by Host: inland-revenue.line.pm URL: https://inland-revenue.line.pm/ret/govtRebate Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 194.55.224.100 , United States, ASN211252 (AS_DELIS, US), Reverse DNS Software Apache/2.4.29 (Ubuntu) / Resource Hash Request headers Referer https://inland-revenue.line.pm/ret/govtRebate accept-language en-NZ,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Content-Type multipart/form-data; boundary=----WebKitFormBoundaryVk97sqGhFuTdrR8t Response headers Pragma no-cache Date Tue, 21 Mar 2023 05:55:25 GMT Server Apache/2.4.29 (Ubuntu) Content-Type text/html; charset=UTF-8 Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Keep-Alive timeout=5, max=99 Content-Length 0 Expires Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ASB Bank (Banking) NZ Government (Government)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			inland-revenue.line.pm/	1969-12-31 23:59:59	Name: PHPSESSID Value: dcevd9v4c0g4e4tmgpa4h3b14c

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

inland-revenue.line.pm
www.gvt-returns.live
192.64.119.167
194.55.224.100
20cfe915c43e2028d600e21c95447fd6fd118acfd3436bf98404d72c45c89f62
282da86e1071d060a343341b75391a036a23e28adfc93e879fae9775e45bfd7d
586d66aa444adb25f168e3a20649d8f31a4459f9ec19f796d8cc131e46768cfe
5b69a0f8a317419ba7f30a64a6cf97223a2544399eb41717f00410baa2ef4c49
7bdafffc801054b76371feb4e9d6905b34018d26680e2db4ec2b75bf0f3516d9
7d0ffca8917b703cd62190ea344dc9a250493abce6b23a88d479d693d14c434a
7dc95d128d0424e708f1156a4875a066335d7b0c9faf7e046f1316b6bb44f4a5
7f0ed5425601a8d17185da1e481efdb42da4bc6b518c0b0096089f4acb27b068
91357ecc89f3a91b7df932f64c9348c2a43443c23c3ce3b10e889b4228bc3a98
9b43b7eb2389af34de87dd534aa3ef80c65614d3a9c26d1945f8f4373f78c554
c03c263c23f5bcc25de2f3216d324cb389f5c1b8543bb52b1e7f0ed483e81928
eda9fb07e8c3fd7c6476407801c2861c937dea801625a140d5c3f8f1e8bbcdd4
f7e29046227820828dca701eb525a37bd7325a33d1c1e9c4dee3a233a18baa05

inland-revenue.line.pm Open in urlscan Pro 194.55.224.100 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

2 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

522 kBTransfer

1352 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 12 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

1 Cookies

Indicators

inland-revenue.line.pm Open in urlscan Pro
194.55.224.100 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

2
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

522 kB
Transfer

1352 kB
Size

1
Cookies

2 HTTP transactions
12 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!