servicesmygov-au.ml
Open in
urlscan Pro
158.101.198.155
Malicious Activity!
Public Scan
Submitted URL: http://bit.do/ATO-myGov
Effective URL: https://servicesmygov-au.ml/ax/
Submission: On August 02 via manual from AU
Effective URL: https://servicesmygov-au.ml/ax/
Submission: On August 02 via manual from AU
Summary
This website contacted 1 IPs
in 1 countries
across 2 domains to perform 13 HTTP transactions.
The main IP is 158.101.198.155, located in
Seattle, United States and
belongs to ORACLE-BMC-31898, US.
The main domain is servicesmygov-au.ml.
TLS certificate: Issued by ZeroSSL RSA Domain Secure Site CA on August 1st 2020. Valid for: 3 months.
This is the only time servicesmygov-au.ml was scanned on urlscan.io!
TLS certificate: Issued by ZeroSSL RSA Domain Secure Site CA on August 1st 2020. Valid for: 3 months.
This is the only time servicesmygov-au.ml was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Australian Government (Government)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 1 | 54.83.52.76 54.83.52.76 | 14618 (AMAZON-AES) (AMAZON-AES) | |
| 13 | 158.101.198.155 158.101.198.155 | 31898 (ORACLE-BM...) (ORACLE-BMC-31898) | |
| 13 | 1 |
1
54.83.52.76
(Ashburn, United States)
ASN14618 (AMAZON-AES, US)
PTR: ec2-54-83-52-76.compute-1.amazonaws.com
ASN14618 (AMAZON-AES, US)
PTR: ec2-54-83-52-76.compute-1.amazonaws.com
| bit.do |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 13 |
servicesmygov-au.ml
servicesmygov-au.ml |
533 KB |
| 1 |
bit.do
1 redirects
bit.do |
226 B |
| 13 | 2 |
| Domain | Requested by | |
|---|---|---|
| 13 | servicesmygov-au.ml |
servicesmygov-au.ml
|
| 1 | bit.do | 1 redirects |
| 13 | 2 |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| servicesmygov-au.ml ZeroSSL RSA Domain Secure Site CA |
2020-08-01 - 2020-10-30 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://servicesmygov-au.ml/ax/
Frame ID: 232F029470FDC40F4DB24A1B1B057C7C
Requests: 12 HTTP requests in this frame
Frame:
https://servicesmygov-au.ml/ax/a.htm
Frame ID: E72E0B2C280DCCDF92D99F3855831AE6
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://bit.do/ATO-myGov
HTTP 301
https://servicesmygov-au.ml/ax/ Page URL
Detected technologies
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Dynatrace
(Analytics)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /dtagent.*\.js/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
URL: https://my.gov.au/mygov
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://bit.do/ATO-myGov
HTTP 301
https://servicesmygov-au.ml/ax/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
servicesmygov-au.ml/ax/ Redirect Chain
|
8 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
dtagent_ICA23STVbjrx_7000100161008.js
servicesmygov-au.ml/ax/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
mgv2-application.css
servicesmygov-au.ml/ax/ |
86 KB 86 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
austgovt-inline-white.svg
servicesmygov-au.ml/ax/ |
113 KB 113 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
mygov-logo.svg
servicesmygov-au.ml/ax/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
austgovt-inline.svg
servicesmygov-au.ml/ax/ |
113 KB 113 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
mgv2-vendor.js
servicesmygov-au.ml/ax/ |
148 KB 148 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
mgv2-application.js
servicesmygov-au.ml/ax/ |
61 KB 61 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
login.js
servicesmygov-au.ml/ax/ |
106 B 361 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
a.htm
servicesmygov-au.ml/ax/ Frame E72E |
315 B 515 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
va_resizelarge.svg
servicesmygov-au.ml/icons/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
va_arrowup.svg
servicesmygov-au.ml/icons/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H/1.1 |
vagt
servicesmygov-au.ml/mga/sps/apiauthsvc/ |
315 B 515 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Australian Government (Government)62 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| moment function| cleanDefaultValues function| setMandatoryValues function| setErrorParent object| formHelper function| getGreetingTime boolean| va_isMaximised boolean| va_isOpen boolean| va_isMobile undefined| va_pushTimeout boolean| va_chatStarted string| titleBarTitle string| headingTitle function| getMobileHeader function| getDesktopHeader function| getAltText function| setAltText function| calcRightMargin function| insertDiv function| insertIframe function| determineContext function| insertIframeSrc function| setIFrameSrc function| sendGoogleAnalyltics function| addTimer function| disableBGScrolling function| enableBGScrolling function| toggleVAMobile function| addOnClickMobile function| isWindowMobile function| responsiveResize function| toggleVADesktop function| addOnClickDesktop function| addOnResize function| resizeVA function| addOnBackwardsTabbing function| loopFocusBackwardWithError function| addSkipToConversationTabListener function| addOnSkipToConversation function| addSkipToBot function| hideSkipToConversation function| skipToSkipToConversation function| skipToResizeIcon function| postMessageToIframe function| addListenerForIframe function| addDigitalAssistant function| scrollPageToBottom function| isIE undefined| lastInteractionDate undefined| timeoutEventId function| getToken function| isValidToken function| parseToken function| checkAuthenticated function| setDAsource function| recordBotInteraction function| initiateNewConversation object| storage function| isWebView object| global0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bit.do
servicesmygov-au.ml
158.101.198.155
54.83.52.76
1452a6016244fba80844ad5443fd03942be627f469589009b77678fbfb46eee1
2938f8c9c0a765bc1ec91b0722cffa3d3a2481fc8708f79857773cdeeabbc6f1
31cb3ea0f2a1b6aa0932caa4e4a7e6c38979a518b82d03f50a6321a84f5dc72d
42ded01e719714429c120fcb2076b685587196056c7e75306c7ba0da5fd91721
63dfa2560a395714c583e4f46845c7806175d99c02ec4f751a0706f5d6caac45
bfce8d8edbde8ae860b20423d3883f5e8f7b60adbfb2160bcba1bea5296685a8
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
d6e20b551788faad5ee8d08a843c1ca521b392065008f9a8051ca74152debba2
f123bda4af8b57bf1a683920703c7841ba38aa4a98c02ef01b92d2b1d2696132