www.city-link.co.in
Open in
urlscan Pro
104.211.113.82
Malicious Activity!
Public Scan
Effective URL: https://www.city-link.co.in/assets/v2v/Re/Login.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZW...
Submission: On February 22 via manual from AU — Scanned from AU
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on October 1st 2022. Valid for: a year.
This is the only time www.city-link.co.in was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Australian Government (Government)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 116.0.20.51 116.0.20.51 | 38719 (DREAMSCAP...) (DREAMSCAPE-AS-AP Dreamscape Networks Limited) | |
3 5 | 104.211.113.82 104.211.113.82 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
2 | 2 |
ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU)
PTR: yebisu.instanthosting.com.au
ecotec.early-holdens.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
city-link.co.in
3 redirects
www.city-link.co.in |
407 KB |
1 |
early-holdens.com
1 redirects
ecotec.early-holdens.com |
474 B |
2 | 2 |
Domain | Requested by | |
---|---|---|
5 | www.city-link.co.in |
3 redirects
www.city-link.co.in
|
1 | ecotec.early-holdens.com | 1 redirects |
2 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
my.gov.au |
beta.my.gov.au |
Subject Issuer | Validity | Valid | |
---|---|---|---|
city-link.co.in Sectigo RSA Domain Validation Secure Server CA |
2022-10-01 - 2023-11-01 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.city-link.co.in/assets/v2v/Re/Login.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMC4wLjU0ODEuMTAwIFNhZmFyaS81MzcuMzYxMDMuMjA5LjI1NC4xMzAyMDIzOkZlYjpUaHU=
Frame ID: 5307CDE751445A396438141EA6D387A4
Requests: 9 HTTP requests in this frame
Screenshot
Page Title
Sign in with myGov - myGovPage URL History Show full URLs
-
https://ecotec.early-holdens.com/user-login/
HTTP 302
https://www.city-link.co.in/assets/v2v/ HTTP 302
https://www.city-link.co.in/assets/v2v/Re HTTP 301
https://www.city-link.co.in/assets/v2v/Re/ HTTP 302
https://www.city-link.co.in/assets/v2v/Re/Login.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNj... Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Page Statistics
6 Outgoing links
These are links going to different origins than the main page.
Title: Create a myGov account
Search URL Search Domain Scan URL
Title: Terms of use
Search URL Search Domain Scan URL
Title: Privacy and security
Search URL Search Domain Scan URL
Title: Copyright
Search URL Search Domain Scan URL
Title: Accessibility
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://ecotec.early-holdens.com/user-login/
HTTP 302
https://www.city-link.co.in/assets/v2v/ HTTP 302
https://www.city-link.co.in/assets/v2v/Re HTTP 301
https://www.city-link.co.in/assets/v2v/Re/ HTTP 302
https://www.city-link.co.in/assets/v2v/Re/Login.php?token=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMC4wLjU0ODEuMTAwIFNhZmFyaS81MzcuMzYxMDMuMjA5LjI1NC4xMzAyMDIzOkZlYjpUaHU= Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
2 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
Login.php
www.city-link.co.in/assets/v2v/Re/ Redirect Chain
|
174 KB 78 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
www.city-link.co.in/assets/v2v/Re/ |
471 KB 328 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
63 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
63 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
256 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
583 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
16 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Australian Government (Government)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| oncontentvisibilityautostatechange2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
ecotec.early-holdens.com/ | Name: PHPSESSID Value: 9k2i2osjerosnpfm3pt0t6rvi2 |
|
www.city-link.co.in/ | Name: PHPSESSID Value: a1641793889nq892i172cb4gnb |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ecotec.early-holdens.com
www.city-link.co.in
104.211.113.82
116.0.20.51
10b11a7c97b90bcf7ad520ac94c5769d08540ce1ee3b84d487c587bf128e3388
5483a6be96ca6714dfd58c32d0f5be344f1bc187572b588fb7730b5c7069e75f
67bcb5c6aab684b17dcc292bb50d7bb419bdaf55683bf2aae27eba0750b3b981
8c6fcb4fc5d0a351b5dcc2fa918d157ea61e6fb74a4e083509e6dcb93d4ff2f6
954aa858b3bffb8511bc41bc88b07d2b24597c37faf522550e26c9aa3b0d220d
af454d272466fa84c77ca8028e0b8b8bcc0a193ad4401dfcddbad07dc2dabcfc
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615