energy.bill.mygov.au.vic-wa.com Open in urlscan Pro
91.234.99.65 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://tags.bluekai.com/site/49051?vid=fdbc19db2ef4478fbeee7cf8df63b054&e_id_m49451=24c4eb200e71b3eb38cd32a42a5f2cc5&e_i...
Effective URL:
https://energy.bill.mygov.au.vic-wa.com/gold/
Submission: On January 25 via manual (January 25th 2023, 12:03:09 am UTC) from AU — Scanned from AU

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 2 countries across 2 domains to perform 9 HTTP transactions. The main IP is 91.234.99.65, located in Belize and belongs to PIHL-AS, BZ. The main domain is energy.bill.mygov.au.vic-wa.com.
TLS certificate: Issued by R3 on January 19th 2023. Valid for: 3 months.

This is the only time energy.bill.mygov.au.vic-wa.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Australian Government (Government)

Domain & IP information

	IP Address	AS Autonomous System
1 1	104.69.166.9 104.69.166.9	16625 (AKAMAI-AS) (AKAMAI-AS)
9	91.234.99.65 91.234.99.65	213058 (PIHL-AS) (PIHL-AS)
9	1

1 104.69.166.9 (Singapore) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-69-166-9.deploy.static.akamaitechnologies.com

tags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 91.234.99.65 (Belize)

ASN213058 (PIHL-AS, BZ)
PTR: getkey02.aetriahesi.info

energy.bill.mygov.au.vic-wa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	vic-wa.com energy.bill.mygov.au.vic-wa.com	84 KB
1	bluekai.com 1 redirects tags.bluekai.com — Cisco Umbrella Rank: 548	721 B
9	2

	Domain	Requested by
9	energy.bill.mygov.au.vic-wa.com	energy.bill.mygov.au.vic-wa.com
1	tags.bluekai.com	1 redirects
9	2

This site contains no links.

Subject Issuer	Validity	Valid
energy.bill.mygov.au.vic-wa.com R3	`2023-01-19` - `2023-04-19`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://energy.bill.mygov.au.vic-wa.com/gold/
Frame ID: DFF2F05C7734AF70752524FCF6607903
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in with myGov - myGov

Page URL History Show full URLs

https://tags.bluekai.com/site/49051?vid=fdbc19db2ef4478fbeee7cf8df63b054&e_id_m49451=24c4eb200e71b3eb... HTTP 302
https://energy.bill.mygov.au.vic-wa.com/gold/ Page URL

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

84 kB
Transfer

198 kB
Size

4
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://tags.bluekai.com/site/49051?vid=fdbc19db2ef4478fbeee7cf8df63b054&e_id_m49451=24c4eb200e71b3eb38cd32a42a5f2cc5&e_id_s49451=81f1690cc2f5589790304e5e3f98360bd48350cd09ff6e39cc8cd0a6e00d5ff2&p_id_m49451=1E2KEoXp9m6NHa9LowxWgVDGrDrbPeyxXq&p_id_s49451=d47529b9a66a643b72a9d2c51e2be9b04509449456107cce3c70f9a7ff797311&redir=https%3A%2F%2Fenergy.bill.mygov.au.vic-wa.com%2Fgold%2F HTTP 302
https://energy.bill.mygov.au.vic-wa.com/gold/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response energy.bill.mygov.au.vic-wa.com/gold/ Redirect Chain https://tags.bluekai.com/site/49051?vid=fdbc19db2ef4478fbeee7cf8df63b054&e_id_m49451=24c4eb200e71b3eb38cd32a42a5f2cc5&e_id_s49451=81f1690cc2f5589790304e5e3f98360bd48350cd09ff6e39cc8cd0a6e00d5ff2&p_... https://energy.bill.mygov.au.vic-wa.com/gold/	3 KB 2 KB	1259ms 425ms	Document text/html	91.234.99.65 PIHL-AS
General Check archive.org Show headers Download Go to Full URL https://energy.bill.mygov.au.vic-wa.com/gold/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 91.234.99.65 , Belize, ASN213058 (PIHL-AS, BZ), Reverse DNS getkey02.aetriahesi.info Software nginx / PHP/5.6.40 Resource Hash `deb8f27f2a51b32fdf75c6f1932afefb7a6685a122c40caf9f0694aa7cd14c60` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 accept-language en-AU,en;q=0.9 Response headers Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection keep-alive Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Wed, 25 Jan 2023 00:03:04 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=60 Pragma no-cache Server nginx Transfer-Encoding chunked Vary Accept-Encoding X-Powered-By PHP/5.6.40 Redirect headers bk-server 65fb content-length 0 date Wed, 25 Jan 2023 00:03:03 GMT location https://energy.bill.mygov.au.vic-wa.com/gold/ p3p CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
GET H/1.1	200 OK	stylesheet_0.css energy.bill.mygov.au.vic-wa.com/gold/	919 B 603 B	364ms 363ms	Stylesheet text/css	91.234.99.65 PIHL-AS
General Check archive.org Show headers Download Go to Full URL https://energy.bill.mygov.au.vic-wa.com/gold/stylesheet_0.css Requested by Host: energy.bill.mygov.au.vic-wa.com URL: https://energy.bill.mygov.au.vic-wa.com/gold/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 91.234.99.65 , Belize, ASN213058 (PIHL-AS, BZ), Reverse DNS getkey02.aetriahesi.info Software nginx / Resource Hash `0227ee6eba293dc24e99779f3ac97b8aa3e660e527e0d8c4e8311d09ff030019` Request headers accept-language en-AU,en;q=0.9 Referer https://energy.bill.mygov.au.vic-wa.com/gold/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Date Wed, 25 Jan 2023 00:03:04 GMT Content-Encoding gzip Last-Modified Mon, 07 Nov 2022 23:37:06 GMT Server nginx ETag W/"636996a2-397" Transfer-Encoding chunked Vary Accept-Encoding Content-Type text/css Cache-Control max-age=315360000 Connection keep-alive Keep-Alive timeout=60 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	stylesheet_1.css energy.bill.mygov.au.vic-wa.com/gold/	15 KB 4 KB	373ms 372ms	Stylesheet text/css	91.234.99.65 PIHL-AS
General Check archive.org Show headers Download Go to Full URL https://energy.bill.mygov.au.vic-wa.com/gold/stylesheet_1.css Requested by Host: energy.bill.mygov.au.vic-wa.com URL: https://energy.bill.mygov.au.vic-wa.com/gold/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 91.234.99.65 , Belize, ASN213058 (PIHL-AS, BZ), Reverse DNS getkey02.aetriahesi.info Software nginx / Resource Hash `a948c2d85e345e69b8bbc55f823964c13370cb300a2e4931f7b92ba343c47ad8` Request headers accept-language en-AU,en;q=0.9 Referer https://energy.bill.mygov.au.vic-wa.com/gold/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Date Wed, 25 Jan 2023 00:03:04 GMT Content-Encoding gzip Last-Modified Mon, 07 Nov 2022 23:37:48 GMT Server nginx ETag W/"636996cc-3c3f" Transfer-Encoding chunked Vary Accept-Encoding Content-Type text/css Cache-Control max-age=315360000 Connection keep-alive Keep-Alive timeout=60 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	stylesheet_2.css energy.bill.mygov.au.vic-wa.com/gold/	21 KB 4 KB	728ms 364ms	Stylesheet text/css	91.234.99.65 PIHL-AS
General Check archive.org Show headers Download Go to Full URL https://energy.bill.mygov.au.vic-wa.com/gold/stylesheet_2.css Requested by Host: energy.bill.mygov.au.vic-wa.com URL: https://energy.bill.mygov.au.vic-wa.com/gold/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 91.234.99.65 , Belize, ASN213058 (PIHL-AS, BZ), Reverse DNS getkey02.aetriahesi.info Software nginx / Resource Hash `207486e0a373e92435f36c3f3c2b764187c39f58243738bb6d9653f23166aedc` Request headers accept-language en-AU,en;q=0.9 Referer https://energy.bill.mygov.au.vic-wa.com/gold/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Date Wed, 25 Jan 2023 00:03:05 GMT Content-Encoding gzip Last-Modified Mon, 07 Nov 2022 22:24:06 GMT Server nginx ETag W/"63698586-54a1" Transfer-Encoding chunked Vary Accept-Encoding Content-Type text/css Cache-Control max-age=315360000 Connection keep-alive Keep-Alive timeout=60 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	9.svg energy.bill.mygov.au.vic-wa.com/gold/images/	63 KB 21 KB	1101ms 746ms	Image image/svg+xml	91.234.99.65 PIHL-AS
General Check archive.org Show headers Download Go to Show image Full URL https://energy.bill.mygov.au.vic-wa.com/gold/images/9.svg Requested by Host: energy.bill.mygov.au.vic-wa.com URL: https://energy.bill.mygov.au.vic-wa.com/gold/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 91.234.99.65 , Belize, ASN213058 (PIHL-AS, BZ), Reverse DNS getkey02.aetriahesi.info Software nginx / Resource Hash `954aa858b3bffb8511bc41bc88b07d2b24597c37faf522550e26c9aa3b0d220d` Request headers accept-language en-AU,en;q=0.9 Referer https://energy.bill.mygov.au.vic-wa.com/gold/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Date Wed, 25 Jan 2023 00:03:05 GMT Content-Encoding gzip Last-Modified Thu, 08 Dec 2022 23:52:54 GMT Server nginx ETag W/"639278d6-fa8f" Transfer-Encoding chunked Vary Accept-Encoding Content-Type image/svg+xml Cache-Control max-age=315360000 Connection keep-alive Keep-Alive timeout=60 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	10.svg energy.bill.mygov.au.vic-wa.com/gold/images/	63 KB 21 KB	1443ms 735ms	Image image/svg+xml	91.234.99.65 PIHL-AS
General Check archive.org Show headers Download Go to Show image Full URL https://energy.bill.mygov.au.vic-wa.com/gold/images/10.svg Requested by Host: energy.bill.mygov.au.vic-wa.com URL: https://energy.bill.mygov.au.vic-wa.com/gold/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 91.234.99.65 , Belize, ASN213058 (PIHL-AS, BZ), Reverse DNS getkey02.aetriahesi.info Software nginx / Resource Hash `10b11a7c97b90bcf7ad520ac94c5769d08540ce1ee3b84d487c587bf128e3388` Request headers accept-language en-AU,en;q=0.9 Referer https://energy.bill.mygov.au.vic-wa.com/gold/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Date Wed, 25 Jan 2023 00:03:05 GMT Content-Encoding gzip Last-Modified Thu, 08 Dec 2022 23:52:54 GMT Server nginx ETag W/"639278d6-fa8c" Transfer-Encoding chunked Vary Accept-Encoding Content-Type image/svg+xml Cache-Control max-age=315360000 Connection keep-alive Keep-Alive timeout=60 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	0.woff2 energy.bill.mygov.au.vic-wa.com/gold/fonts/	11 KB 11 KB	364ms 364ms	Font application/octet-stream	91.234.99.65 PIHL-AS
General Check archive.org Show headers Download Go to Full URL https://energy.bill.mygov.au.vic-wa.com/gold/fonts/0.woff2 Requested by Host: energy.bill.mygov.au.vic-wa.com URL: https://energy.bill.mygov.au.vic-wa.com/gold/stylesheet_0.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 91.234.99.65 , Belize, ASN213058 (PIHL-AS, BZ), Reverse DNS getkey02.aetriahesi.info Software nginx / Resource Hash `796de064b8d80eba7ccacb8ba67d77fdbcdf4b385c844645d452c24537b3108f` Request headers Referer https://energy.bill.mygov.au.vic-wa.com/gold/stylesheet_0.css Origin https://energy.bill.mygov.au.vic-wa.com accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Date Wed, 25 Jan 2023 00:03:05 GMT Last-Modified Thu, 08 Dec 2022 23:52:50 GMT Server nginx ETag "2b14-5ef59bc125880" Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=60 Content-Length 11028
GET H/1.1	200 OK	2.woff2 energy.bill.mygov.au.vic-wa.com/gold/fonts/	11 KB 11 KB	377ms 364ms	Font application/octet-stream	91.234.99.65 PIHL-AS
General Check archive.org Show headers Download Go to Full URL https://energy.bill.mygov.au.vic-wa.com/gold/fonts/2.woff2 Requested by Host: energy.bill.mygov.au.vic-wa.com URL: https://energy.bill.mygov.au.vic-wa.com/gold/stylesheet_0.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 91.234.99.65 , Belize, ASN213058 (PIHL-AS, BZ), Reverse DNS getkey02.aetriahesi.info Software nginx / Resource Hash `0f53e8b0a717ca4ce313eec62b90d41db62c2f4946259a65c93bf8e84c5b0c44` Request headers Referer https://energy.bill.mygov.au.vic-wa.com/gold/stylesheet_0.css Origin https://energy.bill.mygov.au.vic-wa.com accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Date Wed, 25 Jan 2023 00:03:05 GMT Last-Modified Thu, 08 Dec 2022 23:52:50 GMT Server nginx ETag "2b20-5ef59bc125880" Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=60 Content-Length 11040
GET H/1.1	200 OK	1.woff2 energy.bill.mygov.au.vic-wa.com/gold/fonts/	11 KB 11 KB	380ms 366ms	Font application/octet-stream	91.234.99.65 PIHL-AS
General Check archive.org Show headers Download Go to Full URL https://energy.bill.mygov.au.vic-wa.com/gold/fonts/1.woff2 Requested by Host: energy.bill.mygov.au.vic-wa.com URL: https://energy.bill.mygov.au.vic-wa.com/gold/stylesheet_0.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 91.234.99.65 , Belize, ASN213058 (PIHL-AS, BZ), Reverse DNS getkey02.aetriahesi.info Software nginx / Resource Hash `bce2f309470952b7affa62ff4d91b454334c68cefa541429b502904d20696875` Request headers Referer https://energy.bill.mygov.au.vic-wa.com/gold/stylesheet_0.css Origin https://energy.bill.mygov.au.vic-wa.com accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Date Wed, 25 Jan 2023 00:03:05 GMT Last-Modified Thu, 08 Dec 2022 23:52:50 GMT Server nginx ETag "2b40-5ef59bc125880" Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=60 Content-Length 11072

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Australian Government (Government)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.bluekai.com/	1970-01-20 13:29:16	Name: bkdc Value: phx
.bluekai.com/	1970-01-20 13:29:16	Name: bkpa Value: KJhBpzNmyp9xOmY7SVIASl++jyXHxZGOYRxTxVIPF5TBAHou6+v4+0KGcJOsZLr7ZzVImXQYYq08wUSk6jnjD1kVaecVZADAL+jaQXFQzubqgZhbJwuZLzQGtxJ/BBkJ5MDUjhwS8BD0I0FKUla+N9xYj3FKNhxJcvOTzD3NY89nNLTea0eP//bRopP/xxYvPfUplq27LfJw3ts2GpbXwYjbcAf72dj+IE9rhdy3kdwbbXgdFQ+sq0kEYiWa5e7SH1V0BtvpD9q6xwCnQTc/n/TMvvVGsiAbRISMks8LwQbclUfZfZqt4GoX0+CK3+h++NPdSR5MkqbgRXzloNEh6WIicqjk3CdYbsG9
.bluekai.com/	1970-01-20 13:29:16	Name: bku Value: ZfX99n5h6sBV6yGk
energy.bill.mygov.au.vic-wa.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 4h2hn10qk1k6sljo3j10p1i8o1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

energy.bill.mygov.au.vic-wa.com
tags.bluekai.com
104.69.166.9
91.234.99.65
0227ee6eba293dc24e99779f3ac97b8aa3e660e527e0d8c4e8311d09ff030019
0f53e8b0a717ca4ce313eec62b90d41db62c2f4946259a65c93bf8e84c5b0c44
10b11a7c97b90bcf7ad520ac94c5769d08540ce1ee3b84d487c587bf128e3388
207486e0a373e92435f36c3f3c2b764187c39f58243738bb6d9653f23166aedc
796de064b8d80eba7ccacb8ba67d77fdbcdf4b385c844645d452c24537b3108f
954aa858b3bffb8511bc41bc88b07d2b24597c37faf522550e26c9aa3b0d220d
a948c2d85e345e69b8bbc55f823964c13370cb300a2e4931f7b92ba343c47ad8
bce2f309470952b7affa62ff4d91b454334c68cefa541429b502904d20696875
deb8f27f2a51b32fdf75c6f1932afefb7a6685a122c40caf9f0694aa7cd14c60

energy.bill.mygov.au.vic-wa.com Open in urlscan Pro 91.234.99.65 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

9 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

1 IPs

2 Countries

84 kBTransfer

198 kBSize

4 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

4 Cookies

Indicators

energy.bill.mygov.au.vic-wa.com Open in urlscan Pro
91.234.99.65 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

84 kB
Transfer

198 kB
Size

4
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!