URL: https://aus-ato.com/ret/TaxrefundsAU
Submission: On August 08 via manual from AU — Scanned from AU

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 3 HTTP transactions. The main IP is 23.130.97.90, located in Phoenix, United States and belongs to SECURENET, US. The main domain is aus-ato.com.
TLS certificate: Issued by R3 on August 7th 2023. Valid for: 3 months.
This is the only time aus-ato.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Australian Government (Government)

Domain & IP information

IP Address AS Autonomous System
3 23.130.97.90 398646 (SECURENET)
3 2
Apex Domain
Subdomains
Transfer
3 aus-ato.com
aus-ato.com
167 KB
3 1
Domain Requested by
3 aus-ato.com aus-ato.com
3 1

This site contains links to these domains. Also see Links.

Domain
www.ato.gov.au
tap.status.ato.gov.au
www.mygovid.gov.au
info.authorisationmanager.gov.au
Subject Issuer Validity Valid
ato-fail-au.com
R3
2023-08-07 -
2023-11-05
3 months crt.sh

This page contains 1 frames:

Primary Page: https://aus-ato.com/ret/TaxrefundsAU
Frame ID: 171D67980610403F8462448DF0FB69BF
Requests: 8 HTTP requests in this frame

Screenshot

Page Title

Australian Taxation Office

Detected technologies

Overall confidence: 100%
Detected patterns
  • <!-- (?:End )?Google Tag Manager -->

Page Statistics

3
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

252 kB
Transfer

521 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request TaxrefundsAU
aus-ato.com/ret/
403 KB
157 KB
Document
General
Full URL
https://aus-ato.com/ret/TaxrefundsAU
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.130.97.90 Phoenix, United States, ASN398646 (SECURENET, US),
Reverse DNS
schurn.taitory.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
7e99bd882625bdbe0a7f9e3bf7790f4033d77d4ccd39996ae8c893dc55bfd426

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language
en-AU,en;q=0.9

Response headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
Keep-Alive
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Tue, 08 Aug 2023 09:15:26 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive
timeout=5, max=100
Pragma
no-cache
Server
Apache/2.4.29 (Ubuntu)
Transfer-Encoding
chunked
Vary
Accept-Encoding
logo_mygov.png
aus-ato.com/img/
10 KB
11 KB
Image
General
Full URL
https://aus-ato.com/img/logo_mygov.png
Requested by
Host: aus-ato.com
URL: https://aus-ato.com/ret/TaxrefundsAU
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.130.97.90 Phoenix, United States, ASN398646 (SECURENET, US),
Reverse DNS
schurn.taitory.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
585a40899f4a1da0c58d8d50799542eb49de27fc1a8e61f2d305181e036b7b99

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://aus-ato.com/ret/TaxrefundsAU
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Date
Tue, 08 Aug 2023 09:15:30 GMT
Last-Modified
Sun, 17 Jul 2022 10:27:10 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"28f3-5e3fdb1a27b80"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
10483
truncated
/
24 KB
24 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
914c2920b540ac8222f7bada2858386e7fd9343a205348df982fa0381887aa2f

Request headers

Referer
Origin
https://aus-ato.com
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type
font/x-woff
truncated
/
23 KB
23 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
86bd5cea62719e972ecb30a225da8dd26ac36abf36b4640e7107d2d23b112291

Request headers

Referer
Origin
https://aus-ato.com
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type
font/x-woff
truncated
/
14 KB
14 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5db45c35f0a84685c69793584dfd5419a8b9d8777524c74b383e9f69cbe3e433

Request headers

Referer
Origin
https://aus-ato.com
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type
font/x-woff
truncated
/
24 KB
24 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1e6b63c0a2a7834f6f4b185ee7a237040796bfd9e42b897c43ddd88e2ab198b6

Request headers

Referer
Origin
https://aus-ato.com
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type
font/x-woff
truncated
/
23 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0b33cca7a19f002f9b2cf940e735a40d6ba020eb937f9a422b0245d766906a8f

Request headers

accept-language
en-AU,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type
image/png
online
aus-ato.com/user/
0
0
Fetch
General
Full URL
https://aus-ato.com/user/online
Requested by
Host: aus-ato.com
URL: https://aus-ato.com/ret/TaxrefundsAU
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.130.97.90 Phoenix, United States, ASN398646 (SECURENET, US),
Reverse DNS
schurn.taitory.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash

Request headers

Referer
https://aus-ato.com/ret/TaxrefundsAU
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type
multipart/form-data; boundary=----WebKitFormBoundaryBUMaQ4hVbMHyOfqN

Response headers

Pragma
no-cache
Date
Tue, 08 Aug 2023 09:15:33 GMT
Server
Apache/2.4.29 (Ubuntu)
Content-Type
text/html; charset=UTF-8
Cache-Control
no-store, no-cache, must-revalidate
Connection
Keep-Alive
Keep-Alive
timeout=5, max=99
Content-Length
0
Expires
Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Australian Government (Government)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| savepage_ShadowLoader function| select

1 Cookies

Domain/Path Name / Value
aus-ato.com/ Name: PHPSESSID
Value: 1i75ukko5u6ka5ffofmpfttesf

1 Console Messages

Source Level URL
Text
other warning URL: https://aus-ato.com/ret/TaxrefundsAU(Line 59)
Message:
<link rel=preload> has an invalid `href` value