robelee-music.com Open in urlscan Pro
81.169.145.77 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://wp.ajmg-exp.com/
Effective URL:
https://robelee-music.com/Atp/5d356/
Submission: On October 31 via api (October 31st 2022, 5:43:28 am UTC) from AU — Scanned from AU

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 2 domains to perform 11 HTTP transactions. The main IP is 81.169.145.77, located in Germany and belongs to STRATO STRATO AG, DE. The main domain is robelee-music.com.
TLS certificate: Issued by Encryption Everywhere DV TLS CA - G1 on October 27th 2022. Valid for: a year.

This is the only time robelee-music.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Australian Government (Government)

Domain & IP information

	IP Address	AS Autonomous System
1 1	81.169.145.87 81.169.145.87	6724 (STRATO ST...) (STRATO STRATO AG)
2 13	81.169.145.77 81.169.145.77	6724 (STRATO ST...) (STRATO STRATO AG)
11	1

1 81.169.145.87 (Germany) 1 redirects

ASN6724 (STRATO STRATO AG, DE)
PTR: w87.rzone.de

wp.ajmg-exp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 81.169.145.77 (Germany) 2 redirects

ASN6724 (STRATO STRATO AG, DE)
PTR: w0d.rzone.de

robelee-music.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	robelee-music.com 2 redirects robelee-music.com	418 KB
1	ajmg-exp.com 1 redirects wp.ajmg-exp.com	265 B
11	2

	Domain	Requested by
13	robelee-music.com	2 redirects robelee-music.com
1	wp.ajmg-exp.com	1 redirects
11	2

This site contains no links.

Subject Issuer	Validity	Valid
robelee-music.com Encryption Everywhere DV TLS CA - G1	`2022-10-27` - `2023-10-27`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://robelee-music.com/Atp/5d356/
Frame ID: BEF3B64EE989322C4AE1D28F1117D572
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign-in - myGov

Page URL History Show full URLs

http://wp.ajmg-exp.com/ HTTP 301
https://robelee-music.com/Atp/ HTTP 302
https://robelee-music.com/Atp/5d356 HTTP 301
https://robelee-music.com/Atp/5d356/ Page URL

Page Statistics

11
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

1
Countries

418 kB
Transfer

415 kB
Size

4
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://wp.ajmg-exp.com/ HTTP 301
https://robelee-music.com/Atp/ HTTP 302
https://robelee-music.com/Atp/5d356 HTTP 301
https://robelee-music.com/Atp/5d356/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response robelee-music.com/Atp/5d356/ Redirect Chain http://wp.ajmg-exp.com/ https://robelee-music.com/Atp/ https://robelee-music.com/Atp/5d356 https://robelee-music.com/Atp/5d356/	6 KB 6 KB	480ms 480ms	Document text/html	81.169.145.77 STRATO STRATO AG
General Check archive.org Show headers Download Go to Full URL https://robelee-music.com/Atp/5d356/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 81.169.145.77 , Germany, ASN6724 (STRATO STRATO AG, DE), Reverse DNS w0d.rzone.de Software Apache/2.4.54 (Unix) / PHP/8.0.24 Resource Hash `f1ed2a69766e0ed817906617c789fea87a936c60539091f9201cacadcd330e02` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 accept-language en-AU,en;q=0.9 Response headers content-type text/html; charset=UTF-8 date Mon, 31 Oct 2022 05:43:21 GMT server Apache/2.4.54 (Unix) x-powered-by PHP/8.0.24 Redirect headers content-length 244 content-type text/html; charset=iso-8859-1 date Mon, 31 Oct 2022 05:43:21 GMT location https://robelee-music.com/Atp/5d356/ server Apache/2.4.54 (Unix)
GET H2	200	dtagent_ICA23STVbjrx_7000100031020.js Show response robelee-music.com/Atp/5d356/js/	100 KB 101 KB	409ms 408ms	Script application/javascript	81.169.145.77 STRATO STRATO AG
General Check archive.org Show headers Download Go to Full URL https://robelee-music.com/Atp/5d356/js/dtagent_ICA23STVbjrx_7000100031020.js Requested by Host: robelee-music.com URL: https://robelee-music.com/Atp/5d356/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 81.169.145.77 , Germany, ASN6724 (STRATO STRATO AG, DE), Reverse DNS w0d.rzone.de Software Apache/2.4.54 (Unix) / Resource Hash `4da13382bf6de23d6e0f53ea758a945c5550866f5c0590143053bd1c6f371dca` Request headers accept-language en-AU,en;q=0.9 Referer https://robelee-music.com/Atp/5d356/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 31 Oct 2022 05:43:22 GMT last-modified Mon, 31 Oct 2022 05:43:20 GMT server Apache/2.4.54 (Unix) accept-ranges bytes etag "191f3-5ec4e15cad707" content-length 102899 content-type application/javascript
GET H2	200	mgv2-application.css robelee-music.com/Atp/5d356/css/	79 KB 80 KB	1203ms 1202ms	Stylesheet text/css	81.169.145.77 STRATO STRATO AG
General Check archive.org Show headers Download Go to Full URL https://robelee-music.com/Atp/5d356/css/mgv2-application.css Requested by Host: robelee-music.com URL: https://robelee-music.com/Atp/5d356/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 81.169.145.77 , Germany, ASN6724 (STRATO STRATO AG, DE), Reverse DNS w0d.rzone.de Software Apache/2.4.54 (Unix) / Resource Hash `544d046a6d55109b5c84c23561d08fc9653e962a3d9e5744c807f142971b1fc9` Request headers accept-language en-AU,en;q=0.9 Referer https://robelee-music.com/Atp/5d356/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 31 Oct 2022 05:43:22 GMT last-modified Mon, 31 Oct 2022 05:43:20 GMT server Apache/2.4.54 (Unix) accept-ranges bytes etag "13d4c-5ec4e15ca7569" content-length 81228 content-type text/css
GET H2	200	austgovt-inline-white.svg robelee-music.com/Atp/5d356/	113 KB 114 KB	409ms 408ms	Image image/svg+xml	81.169.145.77 STRATO STRATO AG
General Check archive.org Show headers Download Go to Show image Full URL https://robelee-music.com/Atp/5d356/austgovt-inline-white.svg Requested by Host: robelee-music.com URL: https://robelee-music.com/Atp/5d356/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 81.169.145.77 , Germany, ASN6724 (STRATO STRATO AG, DE), Reverse DNS w0d.rzone.de Software Apache/2.4.54 (Unix) / Resource Hash `42ded01e719714429c120fcb2076b685587196056c7e75306c7ba0da5fd91721` Request headers accept-language en-AU,en;q=0.9 Referer https://robelee-music.com/Atp/5d356/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 31 Oct 2022 05:43:23 GMT last-modified Mon, 31 Oct 2022 05:43:20 GMT server Apache/2.4.54 (Unix) accept-ranges bytes etag "1c460-5ec4e15ca36c4" content-length 115808 content-type image/svg+xml
GET H2	200	mygov-logo.svg robelee-music.com/Atp/5d356/	2 KB 2 KB	807ms 807ms	Image image/svg+xml	81.169.145.77 STRATO STRATO AG
General Check archive.org Show headers Download Go to Show image Full URL https://robelee-music.com/Atp/5d356/mygov-logo.svg Requested by Host: robelee-music.com URL: https://robelee-music.com/Atp/5d356/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 81.169.145.77 , Germany, ASN6724 (STRATO STRATO AG, DE), Reverse DNS w0d.rzone.de Software Apache/2.4.54 (Unix) / Resource Hash `91e0d494b2136f506c63c13ebf1ac4a220a6e53a176ee4714505cf3703d0bdbb` Request headers accept-language en-AU,en;q=0.9 Referer https://robelee-music.com/Atp/5d356/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 31 Oct 2022 05:43:23 GMT last-modified Mon, 31 Oct 2022 05:43:20 GMT server Apache/2.4.54 (Unix) accept-ranges bytes etag "8a1-5ec4e15cb4865" content-length 2209 content-type image/svg+xml
GET H2	200	austgovt-inline.svg robelee-music.com/Atp/5d356/	113 KB 114 KB	412ms 411ms	Image image/svg+xml	81.169.145.77 STRATO STRATO AG
General Check archive.org Show headers Download Go to Show image Full URL https://robelee-music.com/Atp/5d356/austgovt-inline.svg Requested by Host: robelee-music.com URL: https://robelee-music.com/Atp/5d356/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 81.169.145.77 , Germany, ASN6724 (STRATO STRATO AG, DE), Reverse DNS w0d.rzone.de Software Apache/2.4.54 (Unix) / Resource Hash `f123bda4af8b57bf1a683920703c7841ba38aa4a98c02ef01b92d2b1d2696132` Request headers accept-language en-AU,en;q=0.9 Referer https://robelee-music.com/Atp/5d356/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 31 Oct 2022 05:43:23 GMT last-modified Mon, 31 Oct 2022 05:43:20 GMT server Apache/2.4.54 (Unix) accept-ranges bytes etag "1c45e-5ec4e15ca3e82" content-length 115806 content-type image/svg+xml
GET H2	404	mgv2-vendor.js robelee-music.com/mygov/content/mgv2/js/	0 0	401ms 400ms	Script text/html	81.169.145.77 STRATO STRATO AG
General Check archive.org Show headers Download Go to Full URL https://robelee-music.com/mygov/content/mgv2/js/mgv2-vendor.js Requested by Host: robelee-music.com URL: https://robelee-music.com/Atp/5d356/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 81.169.145.77 , Germany, ASN6724 (STRATO STRATO AG, DE), Reverse DNS w0d.rzone.de Software Apache/2.4.54 (Unix) / Resource Hash Request headers accept-language en-AU,en;q=0.9 Referer https://robelee-music.com/Atp/5d356/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 31 Oct 2022 05:43:23 GMT server Apache/2.4.54 (Unix) content-length 196 content-type text/html; charset=iso-8859-1
GET H2	404	mgv2-application.js robelee-music.com/mygov/content/mgv2/js/	0 0	401ms 401ms	Script text/html	81.169.145.77 STRATO STRATO AG
General Check archive.org Show headers Download Go to Full URL https://robelee-music.com/mygov/content/mgv2/js/mgv2-application.js Requested by Host: robelee-music.com URL: https://robelee-music.com/Atp/5d356/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 81.169.145.77 , Germany, ASN6724 (STRATO STRATO AG, DE), Reverse DNS w0d.rzone.de Software Apache/2.4.54 (Unix) / Resource Hash Request headers accept-language en-AU,en;q=0.9 Referer https://robelee-music.com/Atp/5d356/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 31 Oct 2022 05:43:23 GMT server Apache/2.4.54 (Unix) content-length 196 content-type text/html; charset=iso-8859-1
GET H2	404	login.js robelee-music.com/mygov/content/mgv2/js/	0 0	401ms 401ms	Script text/html	81.169.145.77 STRATO STRATO AG
General Check archive.org Show headers Download Go to Full URL https://robelee-music.com/mygov/content/mgv2/js/login.js Requested by Host: robelee-music.com URL: https://robelee-music.com/Atp/5d356/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 81.169.145.77 , Germany, ASN6724 (STRATO STRATO AG, DE), Reverse DNS w0d.rzone.de Software Apache/2.4.54 (Unix) / Resource Hash Request headers accept-language en-AU,en;q=0.9 Referer https://robelee-music.com/Atp/5d356/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 31 Oct 2022 05:43:23 GMT server Apache/2.4.54 (Unix) content-length 196 content-type text/html; charset=iso-8859-1
POST H2	404	dynaTraceMonitor Show response robelee-music.com/LoginServices/main/	196 B 247 B	402ms 401ms	XHR text/html	81.169.145.77 STRATO STRATO AG
General Check archive.org Show headers Download Go to Full URL https://robelee-music.com/LoginServices/main/dynaTraceMonitor?type=js&session=MLH7BM0ONCJ5FC25FVB4R41VPGRAUOT0&flavor=post&referer=https%3A%2F%2Frobelee-music.com%2FAtp%2F5d356%2F&app=MyGov&format=lzw Requested by Host: robelee-music.com URL: https://robelee-music.com/Atp/5d356/js/dtagent_ICA23STVbjrx_7000100031020.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 81.169.145.77 , Germany, ASN6724 (STRATO STRATO AG, DE), Reverse DNS w0d.rzone.de Software Apache/2.4.54 (Unix) / Resource Hash `80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880` Request headers Referer https://robelee-music.com/Atp/5d356/ accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Content-Type application/octet-stream Response headers date Mon, 31 Oct 2022 05:43:24 GMT server Apache/2.4.54 (Unix) content-length 196 content-type text/html; charset=iso-8859-1
GET H2	404	dynaTraceMonitor robelee-music.com/LoginServices/main/	196 B 196 B	402ms 401ms	Image text/html	81.169.145.77 STRATO STRATO AG
General Check archive.org Show headers Download Go to Show image Full URL https://robelee-music.com/LoginServices/main/dynaTraceMonitor?bwstate=0&unique=1667195005761&flavor=bandwidth Protocol H2 Security TLS 1.3, , AES_256_GCM Server 81.169.145.77 , Germany, ASN6724 (STRATO STRATO AG, DE), Reverse DNS w0d.rzone.de Software Apache/2.4.54 (Unix) / Resource Hash `80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880` Request headers accept-language en-AU,en;q=0.9 Referer https://robelee-music.com/Atp/5d356/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 31 Oct 2022 05:43:25 GMT server Apache/2.4.54 (Unix) content-length 196 content-type text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Australian Government (Government)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
robelee-music.com/	1969-12-31 23:59:59	Name: dtSa Value: -
robelee-music.com/	1969-12-31 23:59:59	Name: dtLatC Value: 2887
robelee-music.com/	1969-12-31 23:59:59	Name: dtPC Value: -
robelee-music.com/	1969-12-31 23:59:59	Name: dtCookie Value: MLH7BM0ONCJ5FC25FVB4R41VPGRAUOT0

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://robelee-music.com/mygov/content/mgv2/js/mgv2-vendor.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://robelee-music.com/mygov/content/mgv2/js/mgv2-application.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://robelee-music.com/mygov/content/mgv2/js/login.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://robelee-music.com/LoginServices/main/dynaTraceMonitor?type=js&session=MLH7BM0ONCJ5FC25FVB4R41VPGRAUOT0&flavor=post&referer=https%3A%2F%2Frobelee-music.com%2FAtp%2F5d356%2F&app=MyGov&format=lzw Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://robelee-music.com/LoginServices/main/dynaTraceMonitor?bwstate=0&unique=1667195005761&flavor=bandwidth Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

robelee-music.com
wp.ajmg-exp.com
81.169.145.77
81.169.145.87
42ded01e719714429c120fcb2076b685587196056c7e75306c7ba0da5fd91721
4da13382bf6de23d6e0f53ea758a945c5550866f5c0590143053bd1c6f371dca
544d046a6d55109b5c84c23561d08fc9653e962a3d9e5744c807f142971b1fc9
80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
91e0d494b2136f506c63c13ebf1ac4a220a6e53a176ee4714505cf3703d0bdbb
f123bda4af8b57bf1a683920703c7841ba38aa4a98c02ef01b92d2b1d2696132
f1ed2a69766e0ed817906617c789fea87a936c60539091f9201cacadcd330e02

robelee-music.com Open in urlscan Pro 81.169.145.77 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

11 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

1 IPs

1 Countries

418 kBTransfer

415 kBSize

4 Cookies

0 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

12 JavaScript Global Variables

4 Cookies

5 Console Messages

Indicators

robelee-music.com Open in urlscan Pro
81.169.145.77 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

1
Countries

418 kB
Transfer

415 kB
Size

4
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!