my.kituiparkvilla.com
Open in
urlscan Pro
185.208.158.175
Malicious Activity!
Public Scan
Effective URL: https://my.kituiparkvilla.com/
Submission: On June 22 via api from US — Scanned from DE
Summary
TLS certificate: Issued by R11 on June 21st 2024. Valid for: 3 months.
This is the only time my.kituiparkvilla.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Australian Government (Government)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 45.131.41.189 45.131.41.189 | 49505 (SELECTEL) (SELECTEL) | |
1 | 185.208.158.175 185.208.158.175 | 42624 (SIMPLECAR...) (SIMPLECARRIER) | |
1 | 2606:4700::68... 2606:4700::6812:bb1f | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
5 | 161.146.235.204 161.146.235.204 | 18055 (CENTRELIN...) (CENTRELINK Department of Human Services) | |
3 | 2a00:1450:400... 2a00:1450:4001:829::2003 | 15169 (GOOGLE) (GOOGLE) | |
11 | 5 |
ASN49505 (SELECTEL, RU)
PTR: protonmail.com
strtgs.cc |
ASN18055 (CENTRELINK Department of Human Services, AU)
login.my.gov.au |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
my.gov.au
login.my.gov.au |
128 KB |
3 |
gstatic.com
fonts.gstatic.com |
33 KB |
1 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 381 |
18 KB |
1 |
kituiparkvilla.com
my.kituiparkvilla.com |
87 KB |
1 |
strtgs.cc
strtgs.cc |
332 B |
11 | 5 |
Domain | Requested by | |
---|---|---|
5 | login.my.gov.au |
strtgs.cc
my.kituiparkvilla.com |
3 | fonts.gstatic.com |
my.kituiparkvilla.com
|
1 | cdn.jsdelivr.net |
strtgs.cc
|
1 | my.kituiparkvilla.com | |
1 | strtgs.cc | |
11 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
strtgs.cc R11 |
2024-06-17 - 2024-09-15 |
3 months | crt.sh |
my.kituiparkvilla.com R11 |
2024-06-21 - 2024-09-19 |
3 months | crt.sh |
*.jsdelivr.net Sectigo RSA Domain Validation Secure Server CA |
2024-05-04 - 2025-05-04 |
a year | crt.sh |
login.my.gov.au Entrust Certification Authority - L1M |
2024-05-14 - 2025-06-13 |
a year | crt.sh |
*.gstatic.com WR2 |
2024-06-03 - 2024-08-26 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://my.kituiparkvilla.com/
Frame ID: E58E3ECC3951B33BDF346543AA905234
Requests: 11 HTTP requests in this frame
Screenshot
Page Title
Sign inPage URL History Show full URLs
-
http://strtgs.cc/round.php?els=s*******@u****.c**.au&crt=s*******@u****.c**.au
HTTP 307
https://strtgs.cc/round.php?els=s*******@u****.c**.au&crt=s*******@u****.c**.au Page URL
- https://my.kituiparkvilla.com/ Page URL
Detected technologies
jsDelivr (CDN) ExpandDetected patterns
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://strtgs.cc/round.php?els=s*******@u****.c**.au&crt=s*******@u****.c**.au
HTTP 307
https://strtgs.cc/round.php?els=s*******@u****.c**.au&crt=s*******@u****.c**.au Page URL
- https://my.kituiparkvilla.com/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://strtgs.cc/round.php?els=s*******@u****.c**.au&crt=s*******@u****.c**.au HTTP 307
- https://strtgs.cc/round.php?els=s*******@u****.c**.au&crt=s*******@u****.c**.au
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
round.php
strtgs.cc/ Redirect Chain
|
111 B 332 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
my.kituiparkvilla.com/ |
188 KB 87 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
axios.min.js
cdn.jsdelivr.net/npm/axios/dist/ |
51 KB 18 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
myGov-cobranded-logo-black.svg
login.my.gov.au/mygov/content/mgv2/blugov/ |
63 KB 63 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
myGov-cobranded-logo-white.svg
login.my.gov.au/mygov/content/mgv2/blugov/ |
63 KB 63 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
myGov-cobranded-logo-black.svg
login.my.gov.au/mygov/content/mgv2/blugov/ |
63 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
myGov-cobranded-logo-white.svg
login.my.gov.au/mygov/content/mgv2/blugov/ |
63 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-blugov-info.svg
login.my.gov.au/mygov/content/mgv2/icons/ |
583 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v30/ |
11 KB 11 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v30/ |
11 KB 11 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v30/ |
11 KB 11 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Australian Government (Government)16 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
undefined| event object| fence object| sharedStorage string| encoded string| decoded function| bytesToSize object| CryptoJS string| markup number| DSize string| CSize object| hash function| do_encode string| password string| srcCode string| dstCode function| axios1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
login.my.gov.au/ | Name: BIGipServerHBZK2i12N308Oa3l35yEhg Value: !LKdbu3KqZm5uVriGbIznOHjqJgmvmxseNxkhE/cExZJxrr848FiQ3H4kTI9pmDVG9rO3dlI2IhP6Ca8= |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.jsdelivr.net
fonts.gstatic.com
login.my.gov.au
my.kituiparkvilla.com
strtgs.cc
161.146.235.204
185.208.158.175
2606:4700::6812:bb1f
2a00:1450:4001:829::2003
45.131.41.189
0f53e8b0a717ca4ce313eec62b90d41db62c2f4946259a65c93bf8e84c5b0c44
10b11a7c97b90bcf7ad520ac94c5769d08540ce1ee3b84d487c587bf128e3388
796de064b8d80eba7ccacb8ba67d77fdbcdf4b385c844645d452c24537b3108f
8ad11c4cb079bba93156727270f510292eedcc0716c6f21725074a59ec8b9b96
8c6fcb4fc5d0a351b5dcc2fa918d157ea61e6fb74a4e083509e6dcb93d4ff2f6
954aa858b3bffb8511bc41bc88b07d2b24597c37faf522550e26c9aa3b0d220d
a8a63f336775fc8c1d92410c048e4fad8d6aedf2556730c36ebecb0b4e1870f4
bce2f309470952b7affa62ff4d91b454334c68cefa541429b502904d20696875
c3469efa25a66a05b58a48dd653fc9ee48bc01a6b4ec0d37374a164a114f00a7