f0905154.xsph.ru Open in urlscan Pro
141.8.193.236 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://f0905154.xsph.ru/
Effective URL:
http://f0905154.xsph.ru/main/
Submission: On January 09 via manual (January 9th 2024, 11:05:39 pm UTC) from AU — Scanned from AU

Summary HTTP 22 Redirects Links 18 Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 22 HTTP transactions. The main IP is 141.8.193.236, located in Russian Federation and belongs to SPRINTHOST, RU. The main domain is f0905154.xsph.ru.

This is the only time f0905154.xsph.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Australian Government (Government)

Domain & IP information

	IP Address	AS Autonomous System
20	141.8.193.236 141.8.193.236	35278 (SPRINTHOST) (SPRINTHOST)
1	151.101.130.137 151.101.130.137	54113 (FASTLY) (FASTLY)
1	104.17.24.14 104.17.24.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
22	3

20 141.8.193.236 (Russian Federation)

ASN35278 (SPRINTHOST, RU)
PTR: eldir.from.sh

f0905154.xsph.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.130.137 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.24.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
20	xsph.ru f0905154.xsph.ru	1 MB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 395	28 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 1219	29 KB
22	3

	Domain	Requested by
20	f0905154.xsph.ru	f0905154.xsph.ru cdnjs.cloudflare.com
1	cdnjs.cloudflare.com	f0905154.xsph.ru
1	code.jquery.com	f0905154.xsph.ru
22	3

This site contains links to these domains. Also see Links.

Domain
login.my.gov.au
beta.my.gov.au
www.digitalidentity.gov.au
www.mygovid.gov.au
australia.gov.au

Subject Issuer	Validity	Valid
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-11` - `2024-07-14`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-07-03` - `2024-07-02`	a year	crt.sh

This page contains 2 frames:

Primary Page: http://f0905154.xsph.ru/main/
Frame ID: F4F724C0E04CAFFA74162CB5F833CF9B
Requests: 19 HTTP requests in this frame

Frame: http://f0905154.xsph.ru/main/Sign-in%20-%20myGov_files/saved_resource.html
Frame ID: 17B17B09138B6FA6DF4073BB1687D2E6
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign-in - myGov

Page URL History Show full URLs

http://f0905154.xsph.ru/ Page URL
http://f0905154.xsph.ru/main/ Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

22
Requests

9 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

1459 kB
Transfer

5268 kB
Size

7
Cookies

18 Outgoing links

These are links going to different origins than the main page.

URL: https://login.my.gov.au/LoginServices/main/login?execution=e2s1
Title: Skip to Ask a question

Search URL Search Domain Scan URL

URL: https://beta.my.gov.au/?utm_source=blue&utm_medium=banner&utm_campaign=myGov&utm_id=beta&cid=mygovbeta_banner_green_unauth
Title: myGov Beta

Search URL Search Domain Scan URL

URL: https://login.my.gov.au/mygov

Search URL Search Domain Scan URL

URL: https://login.my.gov.au/CredentialManager/recoverUserId.jsp?Origin=&Return=/sps/auth&Login=true
Title: Forgot username

Search URL Search Domain Scan URL

URL: https://login.my.gov.au/CredentialManager/resetPassword.jsp?Origin=&Return=/sps/auth&Login=true
Title: Forgot password

Search URL Search Domain Scan URL

URL: https://login.my.gov.au/LoginServices/main/login?execution=e2s1&_eventId=digitalIdentity
Title: Continue with Digital Identity

Search URL Search Domain Scan URL

URL: https://login.my.gov.au/EnrolService/register.jsp?login=true&Return=/mga/sps/auth
Title: create a myGov account

Search URL Search Domain Scan URL

URL: https://www.digitalidentity.gov.au/
Title: Digital Identity

Search URL Search Domain Scan URL

URL: https://www.mygovid.gov.au/
Title: myGovID

Search URL Search Domain Scan URL

URL: https://australia.gov.au/
Title: australia.gov.au

Search URL Search Domain Scan URL

URL: https://login.my.gov.au/mygov/content/html/about.html
Title: About myGov

Search URL Search Domain Scan URL

URL: https://login.my.gov.au/mygov/content/html/contact.html
Title: Contact us

Search URL Search Domain Scan URL

URL: https://login.my.gov.au/mygov/content/html/terms.html
Title: Terms of use

Search URL Search Domain Scan URL

URL: https://login.my.gov.au/mygov/content/html/privacy.html
Title: Privacy

Search URL Search Domain Scan URL

URL: https://login.my.gov.au/mygov/content/html/copyright.html
Title: Copyright

Search URL Search Domain Scan URL

URL: https://login.my.gov.au/mygov/content/html/security.html
Title: Security

Search URL Search Domain Scan URL

URL: https://login.my.gov.au/mygov/content/html/accessibility.html
Title: Accessibility

Search URL Search Domain Scan URL

URL: https://login.my.gov.au/mygov/content/html/help.html
Title: Help

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://f0905154.xsph.ru/ Page URL
http://f0905154.xsph.ru/main/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

22 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK / Show response
f0905154.xsph.ru/ 358 KB
55 KB 2356ms
776ms Document
text/html 141.8.193.236
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: http://f0905154.xsph.ru/
Protocol: HTTP/1.1
Server: 141.8.193.236 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS: eldir.from.sh
Software: openresty /
Resource Hash: eb1e68a932371128368e6d12a5043921676097c013514b8096a01cd35bb02dee

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Tue, 09 Jan 2024 23:05:32 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Server: openresty
Transfer-Encoding: chunked
Vary: Accept-Encoding

GET
H/1.1 200
OK m3d.css
f0905154.xsph.ru/ 151 B
455 B 299ms
299ms Stylesheet
text/css 141.8.193.236
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: http://f0905154.xsph.ru/m3d.css
Requested by: Host: f0905154.xsph.ru
URL: http://f0905154.xsph.ru/
Protocol: HTTP/1.1
Server: 141.8.193.236 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS: eldir.from.sh
Software: openresty /
Resource Hash: c113ebc50cb4d96a2b7829a0aaca2fe5a01b36197859283dab10767d6a267072

Request headers

accept-language: en-AU,en;q=0.9
Referer: http://f0905154.xsph.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Date: Tue, 09 Jan 2024 23:05:32 GMT
Last-Modified: Thu, 24 Feb 2022 22:41:54 GMT
Server: openresty
ETag: "621809b2-97"
Content-Type: text/css
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 151
Expires: Tue, 16 Jan 2024 23:05:32 GMT

GET
H2 200 jquery-2.2.4.min.js Show response
code.jquery.com/ 84 KB
29 KB 428ms
139ms Script
application/javascript 151.101.130.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-2.2.4.min.js
Requested by: Host: f0905154.xsph.ru
URL: http://f0905154.xsph.ru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Request headers

Referer: http://f0905154.xsph.ru/
Origin: http://f0905154.xsph.ru
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Tue, 09 Jan 2024 23:05:33 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 9937734
x-cache: HIT, HIT
content-length: 29811
x-served-by: cache-lga21935-LGA, cache-bfi-kbfi7400044-BFI
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-timer: S1704841534.573263,VS0,VE0
etag: W/"28feccc0-14e4a"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=604800
accept-ranges: bytes
x-cache-hits: 33, 8019

GET
H2 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.5.0/ 87 KB
28 KB 18ms
8ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.0/jquery.min.js

Requested by

Host: f0905154.xsph.ru
URL: http://f0905154.xsph.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c4dccdd9ae25b64078e0c73f273de94f8894d5c99e4741645ece29aeefc9c5a4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: en-AU,en;q=0.9
Referer: http://f0905154.xsph.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Tue, 09 Jan 2024 23:05:33 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 4157195
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 27964
last-modified: Mon, 04 May 2020 16:11:48 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec4-15d95"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h8jLqvmKHQjHDPfbmKSvyUTq5xQPSZsVSdlptcKbW7evVSkUH2HMVwNs8zpkxza2ZN4Q63WidjR5Hybo9lON%2BRSuTL%2FvySXd9uhITkstAYNY%2Bh3otyI25DW443ledr2P3lLh5Sp2"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8430535ea8baa93e-SYD
expires: Sun, 29 Dec 2024 23:05:33 GMT

GET
H/1.1 200
OK ajax.php
f0905154.xsph.ru/m3dularbh/ 0
158 B 838ms
311ms XHR
text/html 141.8.193.236
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: http://f0905154.xsph.ru/m3dularbh/ajax.php?n=m3d
Requested by: Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.0/jquery.min.js
Protocol: HTTP/1.1
Server: 141.8.193.236 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS: eldir.from.sh
Software: openresty /
Resource Hash

Request headers

Accept: */*
Referer: http://f0905154.xsph.ru/
X-Requested-With: XMLHttpRequest
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Date: Tue, 09 Jan 2024 23:05:34 GMT
Server: openresty
Connection: keep-alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK Primary Request / Show response
f0905154.xsph.ru/main/ 15 KB
5 KB 381ms
381ms Document
text/html 141.8.193.236
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: http://f0905154.xsph.ru/main/
Requested by: Host: f0905154.xsph.ru
URL: http://f0905154.xsph.ru/
Protocol: HTTP/1.1
Server: 141.8.193.236 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS: eldir.from.sh
Software: openresty /
Resource Hash: 50b65fed0f479fd543a6285bfd56a1980e119b600d23302d5f95dbb17417108f

Request headers

Referer: http://f0905154.xsph.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Tue, 09 Jan 2024 23:05:34 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Server: openresty
Transfer-Encoding: chunked
Vary: Accept-Encoding

GET
H/1.1 200
OK ruxitagentjs_ICA2Vfghjqrux_10239220408103229.js.download Show response
f0905154.xsph.ru/main/Sign-in%20-%20myGov_files/ 243 KB
98 KB 315ms
314ms Script
application/javascript 141.8.193.236
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: http://f0905154.xsph.ru/main/Sign-in%20-%20myGov_files/ruxitagentjs_ICA2Vfghjqrux_10239220408103229.js.download
Requested by: Host: f0905154.xsph.ru
URL: http://f0905154.xsph.ru/main/
Protocol: HTTP/1.1
Server: 141.8.193.236 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS: eldir.from.sh
Software: openresty /
Resource Hash: 0fb5ae1c24514ad48f8e743a87eee447b573a30aeb7d8ce16cebf4d5ead810b0

Request headers

accept-language: en-AU,en;q=0.9
Referer: http://f0905154.xsph.ru/main/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Date: Tue, 09 Jan 2024 23:05:35 GMT
Content-Encoding: gzip
Last-Modified: Tue, 09 Aug 2022 06:48:30 GMT
Server: openresty
ETag: W/"3cb60-5e5c951f8cb80"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive

GET
H/1.1 200
OK mgv2-application.css
f0905154.xsph.ru/main/Sign-in%20-%20myGov_files/ 122 KB
24 KB 321ms
320ms Stylesheet
text/css 141.8.193.236
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: http://f0905154.xsph.ru/main/Sign-in%20-%20myGov_files/mgv2-application.css
Requested by: Host: f0905154.xsph.ru
URL: http://f0905154.xsph.ru/main/
Protocol: HTTP/1.1
Server: 141.8.193.236 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS: eldir.from.sh
Software: openresty /
Resource Hash: e8d0781b70b1c2db3eb0ac367588de1c4e9a8d6126f1c8695a08580d83cd2683

Request headers

accept-language: en-AU,en;q=0.9
Referer: http://f0905154.xsph.ru/main/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Date: Tue, 09 Jan 2024 23:05:35 GMT
Content-Encoding: gzip
Last-Modified: Tue, 09 Aug 2022 06:48:30 GMT
Server: openresty
ETag: W/"62f2033e-1e7f4"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=604800
Connection: keep-alive
Expires: Tue, 16 Jan 2024 23:05:35 GMT

GET
H/1.1 200
OK austgovt-inline-white.svg
f0905154.xsph.ru/main/Sign-in%20-%20myGov_files/ 113 KB
37 KB 598ms
308ms Image
image/svg+xml 141.8.193.236
SPRINTHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://f0905154.xsph.ru/main/Sign-in%20-%20myGov_files/austgovt-inline-white.svg
Requested by: Host: f0905154.xsph.ru
URL: http://f0905154.xsph.ru/main/
Protocol: HTTP/1.1
Server: 141.8.193.236 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS: eldir.from.sh
Software: openresty /
Resource Hash: 42ded01e719714429c120fcb2076b685587196056c7e75306c7ba0da5fd91721

Request headers

accept-language: en-AU,en;q=0.9
Referer: http://f0905154.xsph.ru/main/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Date: Tue, 09 Jan 2024 23:05:35 GMT
Content-Encoding: gzip
Last-Modified: Tue, 09 Aug 2022 06:48:30 GMT
Server: openresty
ETag: W/"62f2033e-1c460"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: image/svg+xml
Cache-Control: max-age=604800
Connection: keep-alive
Expires: Tue, 16 Jan 2024 23:05:35 GMT

GET
H/1.1 200
OK mygov-logo.svg
f0905154.xsph.ru/main/Sign-in%20-%20myGov_files/ 2 KB
2 KB 619ms
329ms Image
image/svg+xml 141.8.193.236
SPRINTHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://f0905154.xsph.ru/main/Sign-in%20-%20myGov_files/mygov-logo.svg
Requested by: Host: f0905154.xsph.ru
URL: http://f0905154.xsph.ru/main/
Protocol: HTTP/1.1
Server: 141.8.193.236 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS: eldir.from.sh
Software: openresty /
Resource Hash: 91e0d494b2136f506c63c13ebf1ac4a220a6e53a176ee4714505cf3703d0bdbb

Request headers

accept-language: en-AU,en;q=0.9
Referer: http://f0905154.xsph.ru/main/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Date: Tue, 09 Jan 2024 23:05:35 GMT
Content-Encoding: gzip
Last-Modified: Tue, 09 Aug 2022 06:48:30 GMT
Server: openresty
ETag: W/"62f2033e-8a1"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: image/svg+xml
Cache-Control: max-age=604800
Connection: keep-alive
Expires: Tue, 16 Jan 2024 23:05:35 GMT

GET
H/1.1 200
OK dismiss-x.svg
f0905154.xsph.ru/main/Sign-in%20-%20myGov_files/ 839 B
1 KB 295ms
295ms Image
image/svg+xml 141.8.193.236
SPRINTHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://f0905154.xsph.ru/main/Sign-in%20-%20myGov_files/dismiss-x.svg
Requested by: Host: f0905154.xsph.ru
URL: http://f0905154.xsph.ru/main/
Protocol: HTTP/1.1
Server: 141.8.193.236 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS: eldir.from.sh
Software: openresty /
Resource Hash: a3e9863b69280adb1c01eb12d33cb2fbaeecd5423e15400caad5ff4a5e4aeac9

Request headers

accept-language: en-AU,en;q=0.9
Referer: http://f0905154.xsph.ru/main/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Date: Tue, 09 Jan 2024 23:05:35 GMT
Last-Modified: Tue, 09 Aug 2022 06:48:30 GMT
Server: openresty
ETag: "62f2033e-347"
Content-Type: image/svg+xml
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 839
Expires: Tue, 16 Jan 2024 23:05:35 GMT

GET
H/1.1 200
OK icon-external-link-blue.svg
f0905154.xsph.ru/main/Sign-in%20-%20myGov_files/ 742 B
1 KB 293ms
293ms Image
image/svg+xml 141.8.193.236
SPRINTHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://f0905154.xsph.ru/main/Sign-in%20-%20myGov_files/icon-external-link-blue.svg
Requested by: Host: f0905154.xsph.ru
URL: http://f0905154.xsph.ru/main/
Protocol: HTTP/1.1
Server: 141.8.193.236 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS: eldir.from.sh
Software: openresty /
Resource Hash: e470bb1617b294c5f4c8c456278f819d1640b90c2c15e5d237d3c0683aa32a22

Request headers

accept-language: en-AU,en;q=0.9
Referer: http://f0905154.xsph.ru/main/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Date: Tue, 09 Jan 2024 23:05:36 GMT
Last-Modified: Tue, 09 Aug 2022 06:48:30 GMT
Server: openresty
ETag: "62f2033e-2e6"
Content-Type: image/svg+xml
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 742
Expires: Tue, 16 Jan 2024 23:05:36 GMT

GET
H/1.1 200
OK austgovt-inline.svg
f0905154.xsph.ru/main/Sign-in%20-%20myGov_files/ 71 KB
29 KB 306ms
305ms Image
image/svg+xml 141.8.193.236
SPRINTHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://f0905154.xsph.ru/main/Sign-in%20-%20myGov_files/austgovt-inline.svg
Requested by: Host: f0905154.xsph.ru
URL: http://f0905154.xsph.ru/main/
Protocol: HTTP/1.1
Server: 141.8.193.236 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS: eldir.from.sh
Software: openresty /
Resource Hash: bfbb8c3288312fe27cba0cdd45fe392f7f8af33c3d61c78b133744c7b494c8e8

Request headers

accept-language: en-AU,en;q=0.9
Referer: http://f0905154.xsph.ru/main/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Date: Tue, 09 Jan 2024 23:05:36 GMT
Content-Encoding: gzip
Last-Modified: Tue, 09 Aug 2022 06:48:30 GMT
Server: openresty
ETag: W/"62f2033e-11a6c"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: image/svg+xml
Cache-Control: max-age=604800
Connection: keep-alive
Expires: Tue, 16 Jan 2024 23:05:36 GMT

GET
H/1.1 200
OK mgv2-vendor.js.download Show response
f0905154.xsph.ru/main/Sign-in%20-%20myGov_files/ 148 KB
54 KB 298ms
298ms Script
application/javascript 141.8.193.236
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: http://f0905154.xsph.ru/main/Sign-in%20-%20myGov_files/mgv2-vendor.js.download
Requested by: Host: f0905154.xsph.ru
URL: http://f0905154.xsph.ru/main/
Protocol: HTTP/1.1
Server: 141.8.193.236 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS: eldir.from.sh
Software: openresty /
Resource Hash: 2bedda083bdbe6820e493159f1e3e27146b96ef6840094bd74447925e8c66e26

Request headers

accept-language: en-AU,en;q=0.9
Referer: http://f0905154.xsph.ru/main/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Date: Tue, 09 Jan 2024 23:05:36 GMT
Content-Encoding: gzip
Last-Modified: Tue, 09 Aug 2022 06:48:30 GMT
Server: openresty
ETag: W/"251cf-5e5c951f8cb80"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive

GET
H/1.1 200
OK mgv2-application.js.download Show response
f0905154.xsph.ru/main/Sign-in%20-%20myGov_files/ 74 KB
19 KB 294ms
293ms Script
application/javascript 141.8.193.236
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: http://f0905154.xsph.ru/main/Sign-in%20-%20myGov_files/mgv2-application.js.download
Requested by: Host: f0905154.xsph.ru
URL: http://f0905154.xsph.ru/main/
Protocol: HTTP/1.1
Server: 141.8.193.236 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS: eldir.from.sh
Software: openresty /
Resource Hash: 0b4c8ea1d01a3a04fd23a1e4564a956964006ac5288461327caa1fedee4cc1df

Request headers

accept-language: en-AU,en;q=0.9
Referer: http://f0905154.xsph.ru/main/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Date: Tue, 09 Jan 2024 23:05:36 GMT
Content-Encoding: gzip
Last-Modified: Tue, 09 Aug 2022 06:48:30 GMT
Server: openresty
ETag: W/"1262d-5e5c951f8cb80"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive

GET
H/1.1 200
OK login.js.download Show response
f0905154.xsph.ru/main/Sign-in%20-%20myGov_files/ 2 KB
956 B 292ms
291ms Script
application/javascript 141.8.193.236
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: http://f0905154.xsph.ru/main/Sign-in%20-%20myGov_files/login.js.download
Requested by: Host: f0905154.xsph.ru
URL: http://f0905154.xsph.ru/main/
Protocol: HTTP/1.1
Server: 141.8.193.236 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS: eldir.from.sh
Software: openresty /
Resource Hash: 3398bdeeb65157116e93bdeef72d320cb5d90700b149a62f60ff1dcb2ac8f9a5

Request headers

accept-language: en-AU,en;q=0.9
Referer: http://f0905154.xsph.ru/main/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Date: Tue, 09 Jan 2024 23:05:36 GMT
Content-Encoding: gzip
Last-Modified: Tue, 09 Aug 2022 06:48:30 GMT
Server: openresty
ETag: W/"618-5e5c951f8cb80"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive

GET
H/1.1 404
Not Found link-arrow.svg
f0905154.xsph.ru/main/icons/ 295 B
295 B 557ms
292ms Image
text/html 141.8.193.236
SPRINTHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://f0905154.xsph.ru/main/icons/link-arrow.svg
Requested by: Host: f0905154.xsph.ru
URL: http://f0905154.xsph.ru/main/Sign-in%20-%20myGov_files/mgv2-application.css
Protocol: HTTP/1.1
Server: 141.8.193.236 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS: eldir.from.sh
Software: openresty /
Resource Hash: 1c086112c17a414464b187ecb1393f2281e471152c728e56f8b5ad86f32800f8

Request headers

accept-language: en-AU,en;q=0.9
Referer: http://f0905154.xsph.ru/main/Sign-in%20-%20myGov_files/mgv2-application.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Date: Tue, 09 Jan 2024 23:05:36 GMT
Server: openresty
Connection: keep-alive
Content-Length: 295
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK saved_resource.html Show response
f0905154.xsph.ru/main/Sign-in%20-%20myGov_files/ Frame 17B1 7 KB
3 KB 292ms
291ms Document
text/html 141.8.193.236
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: http://f0905154.xsph.ru/main/Sign-in%20-%20myGov_files/saved_resource.html
Requested by: Host: f0905154.xsph.ru
URL: http://f0905154.xsph.ru/main/
Protocol: HTTP/1.1
Server: 141.8.193.236 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS: eldir.from.sh
Software: openresty /
Resource Hash: a5b2581b953d8504daeab4c2b2fa009544a019ac2754ce8ead7b95d0adfb896d

Request headers

Referer: http://f0905154.xsph.ru/main/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

Cache-Control: max-age=604800
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html
Date: Tue, 09 Jan 2024 23:05:37 GMT
ETag: W/"62f2033e-1d0e"
Expires: Tue, 16 Jan 2024 23:05:37 GMT
Last-Modified: Tue, 09 Aug 2022 06:48:30 GMT
Server: openresty
Transfer-Encoding: chunked
Vary: Accept-Encoding

GET
H/1.1 404
Not Found va_arrowup.svg
f0905154.xsph.ru/main/icons/ 295 B
295 B 292ms
291ms Image
text/html 141.8.193.236
SPRINTHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://f0905154.xsph.ru/main/icons/va_arrowup.svg
Requested by: Host: f0905154.xsph.ru
URL: http://f0905154.xsph.ru/main/Sign-in%20-%20myGov_files/mgv2-application.css
Protocol: HTTP/1.1
Server: 141.8.193.236 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS: eldir.from.sh
Software: openresty /
Resource Hash: a896f5e8577544ae519bea26389b4251ac158b9ab856163a02348ce52fe26754

Request headers

accept-language: en-AU,en;q=0.9
Referer: http://f0905154.xsph.ru/main/Sign-in%20-%20myGov_files/mgv2-application.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Date: Tue, 09 Jan 2024 23:05:37 GMT
Server: openresty
Connection: keep-alive
Content-Length: 295
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found vagt Show response
f0905154.xsph.ru/mga/sps/apiauthsvc/policy/ 300 B
472 B 293ms
293ms XHR
text/html 141.8.193.236
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: http://f0905154.xsph.ru/mga/sps/apiauthsvc/policy/vagt
Requested by: Host: f0905154.xsph.ru
URL: http://f0905154.xsph.ru/main/Sign-in%20-%20myGov_files/ruxitagentjs_ICA2Vfghjqrux_10239220408103229.js.download
Protocol: HTTP/1.1
Server: 141.8.193.236 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS: eldir.from.sh
Software: openresty /
Resource Hash: 3e7bea40f82bfd611ef193a2c74ffa11de8c298676a5b0bd5e1c280b2299655b

Request headers

x-dtpc: -54$241536331_362h2vHRUHFMHUUFKODDONMLHPTVQPPBVMUOHI-0e0
Accept: application/json
Referer: http://f0905154.xsph.ru/main/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
Content-Type: application/json

Response headers

Date: Tue, 09 Jan 2024 23:05:37 GMT
Server: openresty
Connection: keep-alive
Content-Length: 300
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK vendors_main.8221d08a72d89a078615.js.download Show response
f0905154.xsph.ru/main/Sign-in%20-%20myGov_files/ Frame 17B1 4 MB
1 MB 308ms
308ms Script
application/javascript 141.8.193.236
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: http://f0905154.xsph.ru/main/Sign-in%20-%20myGov_files/vendors_main.8221d08a72d89a078615.js.download
Requested by: Host: f0905154.xsph.ru
URL: http://f0905154.xsph.ru/main/Sign-in%20-%20myGov_files/saved_resource.html
Protocol: HTTP/1.1
Server: 141.8.193.236 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS: eldir.from.sh
Software: openresty /
Resource Hash: 4220492e3eccf91a99b094668ad572059a4181dffeabf795fce7b2ec2d82f02f

Request headers

accept-language: en-AU,en;q=0.9
Referer: http://f0905154.xsph.ru/main/Sign-in%20-%20myGov_files/saved_resource.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Date: Tue, 09 Jan 2024 23:05:37 GMT
Content-Encoding: gzip
Last-Modified: Tue, 09 Aug 2022 06:48:30 GMT
Server: openresty
ETag: W/"3d12fa-5e5c951f8cb80"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive

GET
H/1.1 200
OK main.edd90a1d2353255129c9.js.download Show response
f0905154.xsph.ru/main/Sign-in%20-%20myGov_files/ Frame 17B1 31 KB
10 KB 295ms
295ms Script
application/javascript 141.8.193.236
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: http://f0905154.xsph.ru/main/Sign-in%20-%20myGov_files/main.edd90a1d2353255129c9.js.download
Requested by: Host: f0905154.xsph.ru
URL: http://f0905154.xsph.ru/main/Sign-in%20-%20myGov_files/saved_resource.html
Protocol: HTTP/1.1
Server: 141.8.193.236 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS: eldir.from.sh
Software: openresty /
Resource Hash: 5867b8cda07f59ffb9ba08ce2f8961801afbdc974a1a9f88b839b909d1ff2cb7

Request headers

accept-language: en-AU,en;q=0.9
Referer: http://f0905154.xsph.ru/main/Sign-in%20-%20myGov_files/saved_resource.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Date: Tue, 09 Jan 2024 23:05:37 GMT
Content-Encoding: gzip
Last-Modified: Tue, 09 Aug 2022 06:48:30 GMT
Server: openresty
ETag: W/"7c73-5e5c951f8cb80"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Australian Government (Government)

90 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

7 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
f0905154.xsph.ru/	1969-12-31 23:59:59	Name: PHPSESSID Value: 2575657210f43f21994057b4c19e4d08
.xsph.ru/	1969-12-31 23:59:59	Name: dtCookie Value: v_4_srv_-2D54_sn_4UL4TBDSJ950TN28TBL7V2IFCEVSFQES
.xsph.ru/	1970-01-21 03:10:01	Name: rxVisitor Value: 17048415363331KRK20TRNERO79FBIPLPMA2RU1KRE2MH
.xsph.ru/	1969-12-31 23:59:59	Name: dtLatC Value: 1
.xsph.ru/	1969-12-31 23:59:59	Name: dtSa Value: -
.xsph.ru/	1969-12-31 23:59:59	Name: rxvt Value: 1704843336980\|1704841536334
.xsph.ru/	1969-12-31 23:59:59	Name: dtPC Value: -54$241536331_362h1vHRUHFMHUUFKODDONMLHPTVQPPBVMUOHI-0e0

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://f0905154.xsph.ru/main/icons/link-arrow.svg Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: http://f0905154.xsph.ru/main/icons/va_arrowup.svg Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: http://f0905154.xsph.ru/mga/sps/apiauthsvc/policy/vagt Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
code.jquery.com
f0905154.xsph.ru
104.17.24.14
141.8.193.236
151.101.130.137
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
0b4c8ea1d01a3a04fd23a1e4564a956964006ac5288461327caa1fedee4cc1df
0fb5ae1c24514ad48f8e743a87eee447b573a30aeb7d8ce16cebf4d5ead810b0
1c086112c17a414464b187ecb1393f2281e471152c728e56f8b5ad86f32800f8
2bedda083bdbe6820e493159f1e3e27146b96ef6840094bd74447925e8c66e26
3398bdeeb65157116e93bdeef72d320cb5d90700b149a62f60ff1dcb2ac8f9a5
3e7bea40f82bfd611ef193a2c74ffa11de8c298676a5b0bd5e1c280b2299655b
4220492e3eccf91a99b094668ad572059a4181dffeabf795fce7b2ec2d82f02f
42ded01e719714429c120fcb2076b685587196056c7e75306c7ba0da5fd91721
50b65fed0f479fd543a6285bfd56a1980e119b600d23302d5f95dbb17417108f
5867b8cda07f59ffb9ba08ce2f8961801afbdc974a1a9f88b839b909d1ff2cb7
91e0d494b2136f506c63c13ebf1ac4a220a6e53a176ee4714505cf3703d0bdbb
a3e9863b69280adb1c01eb12d33cb2fbaeecd5423e15400caad5ff4a5e4aeac9
a5b2581b953d8504daeab4c2b2fa009544a019ac2754ce8ead7b95d0adfb896d
a896f5e8577544ae519bea26389b4251ac158b9ab856163a02348ce52fe26754
bfbb8c3288312fe27cba0cdd45fe392f7f8af33c3d61c78b133744c7b494c8e8
c113ebc50cb4d96a2b7829a0aaca2fe5a01b36197859283dab10767d6a267072
c4dccdd9ae25b64078e0c73f273de94f8894d5c99e4741645ece29aeefc9c5a4
e470bb1617b294c5f4c8c456278f819d1640b90c2c15e5d237d3c0683aa32a22
e8d0781b70b1c2db3eb0ac367588de1c4e9a8d6126f1c8695a08580d83cd2683
eb1e68a932371128368e6d12a5043921676097c013514b8096a01cd35bb02dee

f0905154.xsph.ru Open in urlscan Pro 141.8.193.236 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

22 Requests

9 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

1459 kBTransfer

5268 kBSize

7 Cookies

18 Outgoing links

Page URL History

Redirected requests

22 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

90 JavaScript Global Variables

7 Cookies

3 Console Messages

Indicators

f0905154.xsph.ru Open in urlscan Pro
141.8.193.236 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

22
Requests

9 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

1459 kB
Transfer

5268 kB
Size

7
Cookies

22 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!