![](/screenshots/b793a93f-c0af-4847-b85c-de325379691f.png)
pub-0c6a110fe9444964a26632b762fe31a7.r2.dev
Open in
urlscan Pro
2606:4700::6812:223
Malicious Activity!
Public Scan
Effective URL: https://pub-0c6a110fe9444964a26632b762fe31a7.r2.dev/blob%20(1).html
Submission: On July 20 via api from US — Scanned from GB
Summary
TLS certificate: Issued by E1 on June 3rd 2024. Valid for: 3 months.
This is the only time pub-0c6a110fe9444964a26632b762fe31a7.r2.dev was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Australian Government (Government)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 93.184.221.165 93.184.221.165 | 15133 (EDGECAST) (EDGECAST) | |
1 | 2606:4700::68... 2606:4700::6812:223 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a04:4e42:200... 2a04:4e42:200::649 | 54113 (FASTLY) (FASTLY) | |
1 | () () | ||
7 | 172.66.44.81 172.66.44.81 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 104.18.10.207 104.18.10.207 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 152.199.19.160 152.199.19.160 | 15133 (EDGECAST) (EDGECAST) | |
1 | 104.17.25.14 104.17.25.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 2a00:1450:400... 2a00:1450:4001:81c::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 161.146.235.204 161.146.235.204 | 18055 (CENTRELIN...) (CENTRELINK Department of Human Services) | |
19 | 11 |
ASN13335 (CLOUDFLARENET, US)
pub-0c6a110fe9444964a26632b762fe31a7.r2.dev |
ASN18055 (CENTRELINK Department of Human Services, AU)
login.my.gov.au |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
pages.dev
gv-44z.pages.dev |
77 KB |
3 |
gstatic.com
fonts.gstatic.com |
47 KB |
2 |
r2.dev
pub-0c6a110fe9444964a26632b762fe31a7.r2.dev |
17 KB |
1 |
my.gov.au
login.my.gov.au — Cisco Umbrella Rank: 900328 |
1 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 336 |
5 KB |
1 |
aspnetcdn.com
ajax.aspnetcdn.com — Cisco Umbrella Rank: 5661 |
30 KB |
1 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1832 |
7 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 1211 |
30 KB |
1 |
t.co
t.co — Cisco Umbrella Rank: 979 |
585 B |
19 | 9 |
Domain | Requested by | |
---|---|---|
7 | gv-44z.pages.dev |
pub-0c6a110fe9444964a26632b762fe31a7.r2.dev
gv-44z.pages.dev |
3 | fonts.gstatic.com |
gv-44z.pages.dev
|
2 | pub-0c6a110fe9444964a26632b762fe31a7.r2.dev |
t.co
pub-0c6a110fe9444964a26632b762fe31a7.r2.dev |
1 | login.my.gov.au | |
1 | cdnjs.cloudflare.com |
pub-0c6a110fe9444964a26632b762fe31a7.r2.dev
|
1 | ajax.aspnetcdn.com |
pub-0c6a110fe9444964a26632b762fe31a7.r2.dev
|
1 | maxcdn.bootstrapcdn.com |
pub-0c6a110fe9444964a26632b762fe31a7.r2.dev
|
1 | code.jquery.com |
pub-0c6a110fe9444964a26632b762fe31a7.r2.dev
|
1 | t.co | |
19 | 9 |
This site contains links to these domains. Also see Links.
Domain |
---|
gv-44z.pages.dev |
my.gov.au |
login.my.gov.au |
www.digitalidentity.gov.au |
www.mygovid.gov.au |
Subject Issuer | Validity | Valid | |
---|---|---|---|
t.co DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2024-05-08 - 2025-05-07 |
a year | crt.sh |
*.r2.dev E1 |
2024-06-03 - 2024-09-01 |
3 months | crt.sh |
*.jquery.com Sectigo ECC Domain Validation Secure Server CA |
2024-06-25 - 2025-06-25 |
a year | crt.sh |
gv-44z.pages.dev WE1 |
2024-06-29 - 2024-09-27 |
3 months | crt.sh |
bootstrapcdn.com GTS CA 1P5 |
2024-05-25 - 2024-08-23 |
3 months | crt.sh |
*.vo.msecnd.net DigiCert SHA2 Secure Server CA |
2024-06-06 - 2025-06-06 |
a year | crt.sh |
cdnjs.cloudflare.com E1 |
2024-06-02 - 2024-08-31 |
3 months | crt.sh |
*.gstatic.com WR2 |
2024-06-24 - 2024-09-16 |
3 months | crt.sh |
login.my.gov.au Entrust Certification Authority - L1M |
2024-05-14 - 2025-06-13 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://pub-0c6a110fe9444964a26632b762fe31a7.r2.dev/blob%20(1).html
Frame ID: 1B7778A3E8547640AAD7ACAB3BFA271E
Requests: 19 HTTP requests in this frame
Screenshot
![](/screenshots/b793a93f-c0af-4847-b85c-de325379691f.png)
Page Title
Sign in with myGov - myGovPage URL History Show full URLs
- https://t.co/6G54m5YIJP Page URL
- https://pub-0c6a110fe9444964a26632b762fe31a7.r2.dev/blob%20(1).html Page URL
Detected technologies
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
15 Outgoing links
These are links going to different origins than the main page.
Title: Skip to main content
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: Help
Search URL Search Domain Scan URL
Title: Having trouble signing in?
Search URL Search Domain Scan URL
Title: Forgot username
Search URL Search Domain Scan URL
Title: Forgot password
Search URL Search Domain Scan URL
Title: Create a myGov account
Search URL Search Domain Scan URL
Title: Digital Identity
Search URL Search Domain Scan URL
Title: myGovID
Search URL Search Domain Scan URL
Title: Continue with Digital Identity
Search URL Search Domain Scan URL
Title: Continue with Digital Identity
Search URL Search Domain Scan URL
Title: Terms of use
Search URL Search Domain Scan URL
Title: Privacy and security
Search URL Search Domain Scan URL
Title: Copyright
Search URL Search Domain Scan URL
Title: Accessibility
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://t.co/6G54m5YIJP Page URL
- https://pub-0c6a110fe9444964a26632b762fe31a7.r2.dev/blob%20(1).html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
6G54m5YIJP
t.co/ |
356 B 585 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
blob%20(1).html
pub-0c6a110fe9444964a26632b762fe31a7.r2.dev/ |
17 KB 17 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.0.min.js
code.jquery.com/ |
87 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET BLOB |
e63c0da1-caec-4a86-b92f-8dc5552d6d59
https://pub-0c6a110fe9444964a26632b762fe31a7.r2.dev/ |
12 KB 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
favicon.ico
pub-0c6a110fe9444964a26632b762fe31a7.r2.dev/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
css.css
gv-44z.pages.dev/css/ |
16 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
mgv2-application.css
gv-44z.pages.dev/css/ |
126 KB 22 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
blugov.css
gv-44z.pages.dev/css/ |
70 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/ |
27 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
myGov-cobranded-logo-black.svg
gv-44z.pages.dev/css/ |
63 KB 21 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
myGov-cobranded-logo-white.svg
gv-44z.pages.dev/css/ |
63 KB 21 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.3.1.min.js
ajax.aspnetcdn.com/ajax/jQuery/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.mask.js
cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.10/ |
20 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
icon-blugov-info.svg
gv-44z.pages.dev/icons/ |
0 406 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
icon-external-link.svg
gv-44z.pages.dev/icons/ |
0 408 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ |
16 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon-16x16.png
login.my.gov.au/mygov/content/mgv2/icons/ |
238 B 1 KB |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- pub-0c6a110fe9444964a26632b762fe31a7.r2.dev
- URL
- https://pub-0c6a110fe9444964a26632b762fe31a7.r2.dev/favicon.ico
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Australian Government (Government)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.t.co/ | Name: muc Value: 57b4a605-1609-4eb2-801d-f19e6add7ee2 |
|
login.my.gov.au/ | Name: BIGipServerHBZK2i12N308Oa3l35yEhg Value: !hsGr+ThASR0Dz5yGbIznOHjqJgmvm9s6lYI+Z3OnDYhiGVkeo89wMn48QqfXkQPglfoJ4eZ3YmLKjQ== |
|
login.my.gov.au/ | Name: PD_STATEFUL_aaa1d6bc-31d2-11e6-b102-0050568e537f Value: %2Fmygov |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=0 |
X-Xss-Protection | 0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.aspnetcdn.com
cdnjs.cloudflare.com
code.jquery.com
fonts.gstatic.com
gv-44z.pages.dev
login.my.gov.au
maxcdn.bootstrapcdn.com
pub-0c6a110fe9444964a26632b762fe31a7.r2.dev
t.co
pub-0c6a110fe9444964a26632b762fe31a7.r2.dev
104.17.25.14
104.18.10.207
152.199.19.160
161.146.235.204
172.66.44.81
2606:4700::6812:223
2a00:1450:4001:81c::2003
2a04:4e42:200::649
93.184.221.165
10b11a7c97b90bcf7ad520ac94c5769d08540ce1ee3b84d487c587bf128e3388
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
19be3c154ce34791944a5411a7a1c5ed8494176d969cc468057405cfa28a6bab
2bb7a6a1c69c680150feae21505a9fca6da3260dc64647ebaff0567543a98d0f
54be6422f7e1bafbbfa001463c9af58aa02588975f8b2c36c6f3787e2c67f5f8
5945b0fe2dad2e35baeccafb7fc37a40cb4f8f5f615d795ea0a9bb20f6935e67
5e70f30259d620e25efa88586a8871d5c94113f0b0d7d6f3e817f585891bf154
62d587573e8fb758992b48ccffea6f8f1391833d14839af2681f512659ec7faa
954aa858b3bffb8511bc41bc88b07d2b24597c37faf522550e26c9aa3b0d220d
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
be483938eb34538b970684f72e312f62652e84b42b7ad86953962d1ce2217c44
daced01a20c71f769238dfbb8a8d735dbc27dcbb7f6dba7777c3e1d9532639c5
ddd92f10ad162c7449eff0acaf40598c05b1111739587edb75e5326b6697c5d5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615