![](/screenshots/60fb2555-6a92-485d-9882-379885421c84.png)
app-284737fb-70c5-4999-9d0a-bb196989342d.cleverapps.io
Open in
urlscan Pro
185.42.117.192
Malicious Activity!
Public Scan
Effective URL: https://app-284737fb-70c5-4999-9d0a-bb196989342d.cleverapps.io/kur/my/las/web.php
Submission: On August 13 via manual from AU — Scanned from AU
Summary
TLS certificate: Issued by R3 on May 26th 2023. Valid for: 3 months.
This is the only time app-284737fb-70c5-4999-9d0a-bb196989342d.cleverapps.io was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Australian Government (Government)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 172.64.148.75 172.64.148.75 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 1 | 104.21.234.214 104.21.234.214 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 2 | 43.245.54.3 43.245.54.3 | 38719 (DREAMSCAP...) (DREAMSCAPE-AS-AP Dreamscape Networks Limited) | |
3 9 | 185.42.117.192 185.42.117.192 | 43424 (MAGICRETAIL) (MAGICRETAIL) | |
11 | 3 |
ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU)
PTR: citizen.hosts.net.nz
sendini.org |
ASN43424 (MAGICRETAIL, FR)
app-284737fb-70c5-4999-9d0a-bb196989342d.cleverapps.io |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
cleverapps.io
3 redirects
app-284737fb-70c5-4999-9d0a-bb196989342d.cleverapps.io |
76 KB |
2 |
sendini.org
1 redirects
sendini.org |
735 B |
1 |
urlz.fr
1 redirects
urlz.fr — Cisco Umbrella Rank: 821304 |
477 B |
1 |
myclickfunnels.com
1 redirects
rediurl937437.myclickfunnels.com |
2 KB |
0 |
gstatic.com
Failed
fonts.gstatic.com Failed |
|
11 | 5 |
Domain | Requested by | |
---|---|---|
9 | app-284737fb-70c5-4999-9d0a-bb196989342d.cleverapps.io |
3 redirects
app-284737fb-70c5-4999-9d0a-bb196989342d.cleverapps.io
|
2 | sendini.org | 1 redirects |
1 | urlz.fr | 1 redirects |
1 | rediurl937437.myclickfunnels.com | 1 redirects |
0 | fonts.gstatic.com Failed |
app-284737fb-70c5-4999-9d0a-bb196989342d.cleverapps.io
|
11 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.cleverapps.io R3 |
2023-05-26 - 2023-08-24 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://app-284737fb-70c5-4999-9d0a-bb196989342d.cleverapps.io/kur/my/las/web.php
Frame ID: 3D3FDAE05E7FECEAD072688EA20A4292
Requests: 11 HTTP requests in this frame
Screenshot
![](/screenshots/60fb2555-6a92-485d-9882-379885421c84.png)
Page Title
Sign in with myGov - myGovPage URL History Show full URLs
-
https://rediurl937437.myclickfunnels.com/myg3083FDSJ
HTTP 302
https://urlz.fr/ncMW HTTP 302
http://sendini.org/llntFK3K.png HTTP 301
http://sendini.org/llntFK3K.png/ Page URL
-
https://app-284737fb-70c5-4999-9d0a-bb196989342d.cleverapps.io/kur/
HTTP 302
https://app-284737fb-70c5-4999-9d0a-bb196989342d.cleverapps.io/kur/my/ HTTP 302
https://app-284737fb-70c5-4999-9d0a-bb196989342d.cleverapps.io/kur/my/las/ HTTP 302
https://app-284737fb-70c5-4999-9d0a-bb196989342d.cleverapps.io/kur/my/las/web.php Page URL
Detected technologies
Detected patterns
- \.php(?:$|\?)
Ahoy (Analytics) Expand
Detected patterns
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://rediurl937437.myclickfunnels.com/myg3083FDSJ
HTTP 302
https://urlz.fr/ncMW HTTP 302
http://sendini.org/llntFK3K.png HTTP 301
http://sendini.org/llntFK3K.png/ Page URL
-
https://app-284737fb-70c5-4999-9d0a-bb196989342d.cleverapps.io/kur/
HTTP 302
https://app-284737fb-70c5-4999-9d0a-bb196989342d.cleverapps.io/kur/my/ HTTP 302
https://app-284737fb-70c5-4999-9d0a-bb196989342d.cleverapps.io/kur/my/las/ HTTP 302
https://app-284737fb-70c5-4999-9d0a-bb196989342d.cleverapps.io/kur/my/las/web.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://rediurl937437.myclickfunnels.com/myg3083FDSJ HTTP 302
- https://urlz.fr/ncMW HTTP 302
- http://sendini.org/llntFK3K.png HTTP 301
- http://sendini.org/llntFK3K.png/
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
sendini.org/llntFK3K.png/ Redirect Chain
|
114 B 479 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
web.php
app-284737fb-70c5-4999-9d0a-bb196989342d.cleverapps.io/kur/my/las/ Redirect Chain
|
6 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
css
app-284737fb-70c5-4999-9d0a-bb196989342d.cleverapps.io/kur/my/las/files/ |
16 KB 1 KB |
Stylesheet
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mgv2-application.css
app-284737fb-70c5-4999-9d0a-bb196989342d.cleverapps.io/kur/my/las/files/ |
123 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
blugov.css
app-284737fb-70c5-4999-9d0a-bb196989342d.cleverapps.io/kur/my/las/files/ |
69 KB 10 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
myGov-cobranded-logo-black.svg
app-284737fb-70c5-4999-9d0a-bb196989342d.cleverapps.io/kur/my/las/files/ |
63 KB 21 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
myGov-cobranded-logo-white.svg
app-284737fb-70c5-4999-9d0a-bb196989342d.cleverapps.io/kur/my/las/files/ |
63 KB 21 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
icon-blugov-info.svg
app-284737fb-70c5-4999-9d0a-bb196989342d.cleverapps.io/kur/my/las/files/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- app-284737fb-70c5-4999-9d0a-bb196989342d.cleverapps.io
- URL
- https://app-284737fb-70c5-4999-9d0a-bb196989342d.cleverapps.io/kur/my/las/files/icon-blugov-info.svg
- Domain
- fonts.gstatic.com
- URL
- https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
- Domain
- fonts.gstatic.com
- URL
- https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
- Domain
- fonts.gstatic.com
- URL
- https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Australian Government (Government)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
5 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
rediurl937437.myclickfunnels.com/ | Name: ahoy_visitor Value: dd8d5906-544d-4371-8114-11172ad33854 |
|
rediurl937437.myclickfunnels.com/ | Name: ahoy_visit Value: 5edc5673-76ab-45c1-b2f6-578f69f91054 |
|
.myclickfunnels.com/ | Name: _cf_session Value: Z8QMVx%2FlvuKMwJ31NezZqVVnB0fM95G%2FO7zXRAx4moBq1PLAIb78Tif634PQrGqxPsrciHFs5F2ZoeUKzinWdioNjsbxkk9SZOiQEgtcFIMJTXAMZlXbGKM2p722xta6hk%2B4CbeslQJGrqSLedKveLqa%2BetkRfelGuClPqy0bvSX4auyXRnvBZ6gtiOBTlbGIVkLM45Jsi4U%2Bz1ShcENZPIGFNvWiHsltido2pbnvPvrV3n68esbJVkgXCDE4kdQC0butaoAQQUVxR3QeWORmvMR1Dhwa7fd71Nl%2BPdmoHajNKU2uPtPOyqMcZtXZyTva0%2FDttxVqwY%3D--xwV06r4%2F8pz5LaHN--SjZh1ms16rMdFPZrJx5scA%3D%3D |
|
.myclickfunnels.com/ | Name: __cf_bm Value: SPXO_varjGdUbCDeK6SAnkSY9s3RtLCl9NBkCtaHyVI-1691970226-0-AXzOX1mk8oBO8XwkkVwhDSvL0YiVmfrrV65qr2YXn4Tx5RGEzeWKmP3Bc9FYaWyz5gX54vVxesfenoEUAZxmuGU= |
|
sendini.org/ | Name: PHPSESSID Value: 9g9iaadvvecim1e3eamgmki9i1 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
app-284737fb-70c5-4999-9d0a-bb196989342d.cleverapps.io
fonts.gstatic.com
rediurl937437.myclickfunnels.com
sendini.org
urlz.fr
app-284737fb-70c5-4999-9d0a-bb196989342d.cleverapps.io
fonts.gstatic.com
104.21.234.214
172.64.148.75
185.42.117.192
43.245.54.3
00b399de3012a5f809a1fb531286f8cdb5e7671e865f0423a0ba0dfffcc8d9c5
10b11a7c97b90bcf7ad520ac94c5769d08540ce1ee3b84d487c587bf128e3388
6b029a47a7bb72e8b70cf436b83d904b8a366fd360d12b4d8917c9f59e4b7d46
8f1dcb44402c0f1d445ef7a9d8553936be27d3baaaa512de16d9ae774f4a5316
954aa858b3bffb8511bc41bc88b07d2b24597c37faf522550e26c9aa3b0d220d
b77c129d80f9935328bd9647f4cd9fe2eab8a858dd8dd40cdb70f351681c9998
ca72017bbc6457c0fadb84afe2d0657e7a6d2455d8a1def279221c12ed892c3a