![](/screenshots/73c17de0-3f09-4b8d-95fc-bb08d0e28c3a.png)
voc.lcb.mybluehost.me
Open in
urlscan Pro
50.87.172.242
Malicious Activity!
Public Scan
Effective URL: https://voc.lcb.mybluehost.me/en/MyGov/620743/Re/?caller=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLa...
Submission: On November 22 via manual from AU — Scanned from AU
Summary
TLS certificate: Issued by R3 on November 13th 2023. Valid for: 3 months.
This is the only time voc.lcb.mybluehost.me was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Australian Government (Government)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 104.26.4.19 104.26.4.19 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
6 10 | 50.87.172.242 50.87.172.242 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
4 | 2 |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: box2508.bluehost.com
voc.lcb.mybluehost.me |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
mybluehost.me
6 redirects
voc.lcb.mybluehost.me |
380 KB |
1 |
surl.li
1 redirects
www.surl.li |
1 KB |
4 | 2 |
Domain | Requested by | |
---|---|---|
10 | voc.lcb.mybluehost.me |
6 redirects
voc.lcb.mybluehost.me
|
1 | www.surl.li | 1 redirects |
4 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
cpcontacts.voc.lcb.mybluehost.me R3 |
2023-11-13 - 2024-02-11 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://voc.lcb.mybluehost.me/en/MyGov/620743/Re/?caller=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExOS4wLjYwNDUuMTU5IFNhZmFyaS81MzcuMzYxMTYuOTAuNzIuNTMyMDIzOk5vdjpXZWQ=
Frame ID: 31584EFFE93982BF6D3A4405AF5937C0
Requests: 9 HTTP requests in this frame
Screenshot
![](/screenshots/73c17de0-3f09-4b8d-95fc-bb08d0e28c3a.png)
Page Title
Sign in with myGov - myGovPage URL History Show full URLs
-
https://www.surl.li/nikyw
HTTP 301
https://voc.lcb.mybluehost.me/la2 HTTP 301
https://voc.lcb.mybluehost.me/en/MyGov HTTP 301
https://voc.lcb.mybluehost.me/en/MyGov/ HTTP 302
https://voc.lcb.mybluehost.me/en/MyGov/620743 HTTP 301
https://voc.lcb.mybluehost.me/en/MyGov/620743/ HTTP 302
https://voc.lcb.mybluehost.me/en/MyGov/620743/Re?caller=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IH... HTTP 301
https://voc.lcb.mybluehost.me/en/MyGov/620743/Re/?caller=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7I... Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://www.surl.li/nikyw
HTTP 301
https://voc.lcb.mybluehost.me/la2 HTTP 301
https://voc.lcb.mybluehost.me/en/MyGov HTTP 301
https://voc.lcb.mybluehost.me/en/MyGov/ HTTP 302
https://voc.lcb.mybluehost.me/en/MyGov/620743 HTTP 301
https://voc.lcb.mybluehost.me/en/MyGov/620743/ HTTP 302
https://voc.lcb.mybluehost.me/en/MyGov/620743/Re?caller=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExOS4wLjYwNDUuMTU5IFNhZmFyaS81MzcuMzYxMTYuOTAuNzIuNTMyMDIzOk5vdjpXZWQ= HTTP 301
https://voc.lcb.mybluehost.me/en/MyGov/620743/Re/?caller=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExOS4wLjYwNDUuMTU5IFNhZmFyaS81MzcuMzYxMTYuOTAuNzIuNTMyMDIzOk5vdjpXZWQ= Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
4 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
voc.lcb.mybluehost.me/en/MyGov/620743/Re/ Redirect Chain
|
5 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
voc.lcb.mybluehost.me/en/MyGov/620743/Re/ |
471 KB 251 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo-black.svg
voc.lcb.mybluehost.me/en/MyGov/620743/Re/assets/ |
63 KB 63 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo-white.svg
voc.lcb.mybluehost.me/en/MyGov/620743/Re/assets/ |
63 KB 63 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
256 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
583 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
16 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Australian Government (Government)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.surl.li/ | Name: XSRF-TOKEN Value: eyJpdiI6ImJBUTg5T2pocExTSjdCMTQ4MXdHS0E9PSIsInZhbHVlIjoiNDNiZkNRcFhTRGcrTUNwblZMU0s4OFRSdGRsR2l0bnFjUHNXTU40SkZDTU1XQUhIRVNueEZiQjI1TDkydmNxdEtnejBxZ3V2WjJEQ1UwVGRYTmxuSnAzYmlvTmpETER3VVJMaHJGVFpPdWd3VUFxQ2xCZ3VSUGMvOGpuWk9IOGwiLCJtYWMiOiJhY2YzNzkxNzY5NWQ1NjJlZDU2Zjk1MjUwNmRlYTkxMDIyMzk1MzYzNTRlZWU5Y2RiMTlkNTliOWEyNjAwYzJmIiwidGFnIjoiIn0%3D |
|
www.surl.li/ | Name: surli_application_session Value: eyJpdiI6IndOd250azhHbjJZY2tMZ0ZtdW9SVGc9PSIsInZhbHVlIjoiK0tsUUZZWFE2dnRTb1NHWjNCand2b2xzK2g5TksvUHFlVHkrRFVaU0owckRLcmE0dDhCTnJvTDEveFI1RU9ja2pJTEN0RE5Od2FXcmZRbmlkNkR4bmVoeiszeHpibnl3NWEvWUFsRktLMExyUGUydTA1U3U0RmpMYy9mZUFRY3MiLCJtYWMiOiIxZjZlMDM2YmU5NmJmZGNkNDQ4MzRjZmVmNmFlYTA4YWM3ODkxOGNiMDIwZTAwN2M5ODhhNjExODJjMWMzNTdkIiwidGFnIjoiIn0%3D |
|
voc.lcb.mybluehost.me/ | Name: PHPSESSID Value: f87a0b5d6f1311e057252e2a2b19ae97 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
voc.lcb.mybluehost.me
www.surl.li
104.26.4.19
50.87.172.242
10b11a7c97b90bcf7ad520ac94c5769d08540ce1ee3b84d487c587bf128e3388
5483a6be96ca6714dfd58c32d0f5be344f1bc187572b588fb7730b5c7069e75f
8c6fcb4fc5d0a351b5dcc2fa918d157ea61e6fb74a4e083509e6dcb93d4ff2f6
954aa858b3bffb8511bc41bc88b07d2b24597c37faf522550e26c9aa3b0d220d
af454d272466fa84c77ca8028e0b8b8bcc0a193ad4401dfcddbad07dc2dabcfc
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f5bba88a2ab5725b2bb465d064477cbcc26f9f129f008878c726292ee174100a
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615