mygovservice-001-site1.dtempurl.com
Open in
urlscan Pro
205.144.171.178
Malicious Activity!
Public Scan
Submission: On August 27 via automatic, source certstream-suspicious — Scanned from DE
Summary
TLS certificate: Issued by R3 on August 27th 2023. Valid for: 3 months.
This is the only time mygovservice-001-site1.dtempurl.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Australian Government (Government)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
15 | 205.144.171.178 205.144.171.178 | 55778 (WEBWEB-HK...) (WEBWEB-HK International Trade Centre) | |
3 | 2a00:1450:400... 2a00:1450:4001:812::2003 | 15169 (GOOGLE) (GOOGLE) | |
18 | 2 |
ASN55778 (WEBWEB-HK International Trade Centre, HK)
PTR: 205-144-171-178.alchemy.net
mygovservice-001-site1.dtempurl.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
15 |
dtempurl.com
mygovservice-001-site1.dtempurl.com |
320 KB |
3 |
gstatic.com
fonts.gstatic.com |
47 KB |
18 | 2 |
Domain | Requested by | |
---|---|---|
15 | mygovservice-001-site1.dtempurl.com |
mygovservice-001-site1.dtempurl.com
|
3 | fonts.gstatic.com |
mygovservice-001-site1.dtempurl.com
|
18 | 2 |
Subject Issuer | Validity | Valid | |
---|---|---|---|
mygovservice-001-site1.dtempurl.com R3 |
2023-08-27 - 2023-11-25 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-08-07 - 2023-10-30 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://mygovservice-001-site1.dtempurl.com/
Frame ID: C4E8B5DC6CC10F40645485C6DED3BBA7
Requests: 18 HTTP requests in this frame
7 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: Help
Search URL Search Domain Scan URL
Title: Create a myGov account
Search URL Search Domain Scan URL
Title: Terms of use
Search URL Search Domain Scan URL
Title: Privacy and security
Search URL Search Domain Scan URL
Title: Copyright
Search URL Search Domain Scan URL
Title: Accessibility
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
18 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
mygovservice-001-site1.dtempurl.com/ |
8 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ruxitagentjs_ICA2NVfghjqrux_10253221019152312.js
mygovservice-001-site1.dtempurl.com/mygov.me.au_files/ |
253 KB 90 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css.css
mygovservice-001-site1.dtempurl.com/mygov.me.au_files/ |
17 KB 917 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mgv2-application.css
mygovservice-001-site1.dtempurl.com/mygov.me.au_files/ |
126 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
blugov.css
mygovservice-001-site1.dtempurl.com/mygov.me.au_files/ |
70 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
myGov-cobranded-logo-black.svg
mygovservice-001-site1.dtempurl.com/mygov.me.au_files/ |
63 KB 63 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
myGov-cobranded-logo-white.svg
mygovservice-001-site1.dtempurl.com/mygov.me.au_files/ |
63 KB 63 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mgv2-vendor.js
mygovservice-001-site1.dtempurl.com/mygov.me.au_files/ |
149 KB 48 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mgv2-application.js
mygovservice-001-site1.dtempurl.com/mygov.me.au_files/ |
74 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login.js
mygovservice-001-site1.dtempurl.com/mygov.me.au_files/ |
2 KB 666 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
blugov-left-chevron-dark.svg
mygovservice-001-site1.dtempurl.com/icons/ |
1 KB 1 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon-blugov-info.svg
mygovservice-001-site1.dtempurl.com/icons/ |
1 KB 1 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ |
16 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
M-myGov-Coloured%20Line.svg
mygovservice-001-site1.dtempurl.com/blugov/ |
1 KB 1 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
rb_6de8e2e9-6719-45b3-86be-7effcb9f6525
mygovservice-001-site1.dtempurl.com/LoginServices/main/ |
1 KB 1 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
rb_6de8e2e9-6719-45b3-86be-7effcb9f6525
mygovservice-001-site1.dtempurl.com/LoginServices/main/ |
1 KB 1 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Australian Government (Government)89 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture object| dT_ object| dtrum object| dynatrace function| $ function| moment function| cleanDefaultValues function| setMandatoryValues function| findInfoOrErrorParent function| findSuccessParent function| clearMessageType function| setErrorParent object| formHelper function| getGreetingTime function| initPinToggle function| setPinShow function| setPinHide boolean| va_isMaximised boolean| va_isOpen boolean| va_isMobile undefined| va_pushTimeout boolean| va_chatStarted string| titleBarTitle string| headingTitle function| getMobileHeader function| getDesktopHeader function| getAltText function| setAltText function| calcRightMargin function| insertDiv function| insertIframe function| determineContext function| insertIframeSrc function| setIFrameSrc function| sendGoogleAnalyltics function| addTimer function| disableBGScrolling function| enableBGScrolling function| toggleVAMobile function| addOnClickMobile function| isWindowMobile function| responsiveResize function| toggleVADesktop function| addOnClickDesktop function| addOnResize function| resizeVA function| addOnBackwardsTabbing function| loopFocusBackwardWithError function| addSkipToConversationTabListener function| addOnSkipToConversation function| addSkipToBot function| hideSkipToConversation function| skipToSkipToConversation function| skipToResizeIcon function| postMessageToIframe function| addListenerForIframe function| addDigitalAssistant function| scrollPageToBottom function| isIE function| newShowIdentityModal function| ignoreSubmit function| handleKeyboardInput function| trapFocusPrimary function| removeSelection function| trapFocusSecondary function| keyboardDismiss function| enableProgressButton function| summonSecondModal function| hideSecondaryModal function| harshHideIdentityModal function| fadeOutBackground function| newHideIdentityModal undefined| lastInteractionDate undefined| timeoutEventId function| getToken function| isValidToken function| parseToken function| checkAuthenticated function| setDAsource function| recordBotInteraction function| initiateNewConversation object| storage function| isWebView object| global function| priorityLookup function| compareDates function| getTopAlert function| getTopBroadcast function| displayBroadcast6 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.dtempurl.com/ | Name: dtCookie Value: v_4_srv_-2D24_sn_T90VLQDO2S02CCFBJU17FICEKTD63MV2 |
|
.dtempurl.com/ | Name: rxVisitor Value: 1693119862904AJCDFB5N8ST0J5DKC9EE50QNCGBHJRIH |
|
.dtempurl.com/ | Name: dtLatC Value: 188 |
|
.dtempurl.com/ | Name: dtSa Value: - |
|
.dtempurl.com/ | Name: rxvt Value: 1693121663303|1693119862905 |
|
.dtempurl.com/ | Name: dtPC Value: -24$519862901_135h-vUCUKJCHEKHPJCVRCMAFAIMRGQDMKCFCM-0e0 |
5 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.gstatic.com
mygovservice-001-site1.dtempurl.com
205.144.171.178
2a00:1450:4001:812::2003
107af7740499970450ef1475538b290f01f48e863cb6660e272066843582cec8
10b11a7c97b90bcf7ad520ac94c5769d08540ce1ee3b84d487c587bf128e3388
3398bdeeb65157116e93bdeef72d320cb5d90700b149a62f60ff1dcb2ac8f9a5
62d587573e8fb758992b48ccffea6f8f1391833d14839af2681f512659ec7faa
7b4cd516460c707d9a053b614464b901c2f84c1dc387dcc5dcf7f0e67f4b549c
954aa858b3bffb8511bc41bc88b07d2b24597c37faf522550e26c9aa3b0d220d
99aad7cadb122d002d7b0931fb04f570b160e01b4a2bc8b7883eade95ae550c2
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
c1bdc8ba35b5f834cb959a258f9d3c618fa7939799af6242065ece73c5be7c44
d5b4100390103b8d34ff17f189458302af962104b608cd52440f96f32b5646e5
dc1d54dab6ec8c00f70137927504e4f222c8395f10760b6beecfcfa94e08249f
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
fae4a02846c8310e2f36342155b07b7d70d3229830470d86bda83d82ff7088fe