easyair.co.zw Open in urlscan Pro
2a01:4f9:3a:1f18::2  Malicious Activity! Public Scan

7 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request addcc.php Show response easyair.co.zw/wp-content/mygov/app/	9 KB 3 KB	263ms 196ms	Document text/html	2a01:4f9:3a:1f18::2 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://easyair.co.zw/wp-content/mygov/app/addcc.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a01:4f9:3a:1f18::2 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software LiteSpeed / Resource Hash ebc306a24f3d2b7e6a13d9e2d323f5fe903513d1afa8b2c75bf11e3a7c1f5ae8 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" cache-control no-store, no-cache, must-revalidate content-encoding gzip content-length 3179 content-type text/html; charset=UTF-8 date Tue, 09 Jul 2024 15:20:38 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server LiteSpeed vary Accept-Encoding
GET H2	200	ruxitagentjs_ICA2Vfghjqrux_10243220606153550.js.download Show response easyair.co.zw/wp-content/mygov/app/login_files/	239 KB 239 KB	95ms 93ms	Script application/octet-stream	2a01:4f9:3a:1f18::2 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://easyair.co.zw/wp-content/mygov/app/login_files/ruxitagentjs_ICA2Vfghjqrux_10243220606153550.js.download Requested by Host: easyair.co.zw URL: https://easyair.co.zw/wp-content/mygov/app/addcc.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a01:4f9:3a:1f18::2 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software LiteSpeed / Resource Hash 551d6fdc92d330f73f7b1b18554fd619d72aa8e883f8192a05f6466049ae58b9 Request headers Referer https://easyair.co.zw/wp-content/mygov/app/addcc.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Tue, 09 Jul 2024 15:20:38 GMT last-modified Fri, 05 Jul 2024 22:30:55 GMT server LiteSpeed etag "3bc81-6688741f-1d413fa;;;" content-type application/octet-stream accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 244865
GET H2	200	css easyair.co.zw/wp-content/mygov/app/login_files/	16 KB 16 KB	63ms 62ms	Stylesheet text/plain	2a01:4f9:3a:1f18::2 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://easyair.co.zw/wp-content/mygov/app/login_files/css Requested by Host: easyair.co.zw URL: https://easyair.co.zw/wp-content/mygov/app/addcc.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a01:4f9:3a:1f18::2 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software LiteSpeed / Resource Hash 00b399de3012a5f809a1fb531286f8cdb5e7671e865f0423a0ba0dfffcc8d9c5 Request headers Referer https://easyair.co.zw/wp-content/mygov/app/addcc.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Tue, 09 Jul 2024 15:20:38 GMT last-modified Fri, 05 Jul 2024 22:30:55 GMT server LiteSpeed accept-ranges bytes etag "3e92-6688741f-1d413f3;;;" content-length 16018 alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
GET H2	200	mgv2-application.css easyair.co.zw/wp-content/mygov/app/login_files/	122 KB 19 KB	63ms 62ms	Stylesheet text/css	2a01:4f9:3a:1f18::2 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://easyair.co.zw/wp-content/mygov/app/login_files/mgv2-application.css Requested by Host: easyair.co.zw URL: https://easyair.co.zw/wp-content/mygov/app/addcc.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a01:4f9:3a:1f18::2 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software LiteSpeed / Resource Hash e4b278f03b15d98341b6b1960e1b1d8c34dbd53cdec867348be0d728317ae756 Request headers Referer https://easyair.co.zw/wp-content/mygov/app/addcc.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Tue, 09 Jul 2024 15:20:38 GMT content-encoding br last-modified Fri, 05 Jul 2024 22:30:55 GMT server LiteSpeed etag "1e9fc-6688741f-1d413f5;br" vary Accept-Encoding content-type text/css cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 19239 expires Tue, 16 Jul 2024 15:20:38 GMT
GET H2	200	blugov.css easyair.co.zw/wp-content/mygov/app/login_files/	69 KB 9 KB	93ms 93ms	Stylesheet text/css	2a01:4f9:3a:1f18::2 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://easyair.co.zw/wp-content/mygov/app/login_files/blugov.css Requested by Host: easyair.co.zw URL: https://easyair.co.zw/wp-content/mygov/app/addcc.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a01:4f9:3a:1f18::2 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software LiteSpeed / Resource Hash 5ad45c3c8b9efc9e5427d60339eb9b65ffa97a501fe111fe373b100393acc405 Request headers Referer https://easyair.co.zw/wp-content/mygov/app/addcc.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Tue, 09 Jul 2024 15:20:38 GMT content-encoding br last-modified Fri, 05 Jul 2024 22:30:55 GMT server LiteSpeed etag "11275-6688741f-1d413f2;br" vary Accept-Encoding content-type text/css cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 9263 expires Tue, 16 Jul 2024 15:20:38 GMT
GET H2	200	myGov-cobranded-logo-black.svg easyair.co.zw/wp-content/mygov/app/login_files/	63 KB 20 KB	187ms 186ms	Image image/svg+xml	2a01:4f9:3a:1f18::2 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://easyair.co.zw/wp-content/mygov/app/login_files/myGov-cobranded-logo-black.svg Requested by Host: easyair.co.zw URL: https://easyair.co.zw/wp-content/mygov/app/addcc.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a01:4f9:3a:1f18::2 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software LiteSpeed / Resource Hash 954aa858b3bffb8511bc41bc88b07d2b24597c37faf522550e26c9aa3b0d220d Request headers Referer https://easyair.co.zw/wp-content/mygov/app/addcc.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Tue, 09 Jul 2024 15:20:38 GMT content-encoding br last-modified Fri, 05 Jul 2024 22:30:55 GMT server LiteSpeed etag "fa8f-6688741f-1d413f8;br" vary Accept-Encoding content-type image/svg+xml cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 20310 expires Tue, 16 Jul 2024 15:20:38 GMT
GET H/1.1	200 OK	1-18686_transparent-visa-mastercard-png-white-visa-logo-png.png www.pngitem.com/pimgs/m/	22 KB 22 KB	661ms 329ms	Image image/png	204.12.226.4 WII
General Check archive.org Show headers Download Go to Show image Full URL https://www.pngitem.com/pimgs/m/1-18686_transparent-visa-mastercard-png-white-visa-logo-png.png Requested by Host: easyair.co.zw URL: https://easyair.co.zw/wp-content/mygov/app/addcc.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 204.12.226.4 , United States, ASN32097 (WII, US), Reverse DNS Software nginx/1.14.0 / Resource Hash a188842e336829593dd3f8b212b576bd9f08ac93bdc3e95fe32e6c1126dac318 Request headers Referer https://easyair.co.zw/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Date Tue, 09 Jul 2024 15:20:38 GMT Content-Encoding gzip Last-Modified Fri, 09 Dec 2022 08:03:42 GMT Server nginx/1.14.0 ETag W/"6392ebde-596d" Transfer-Encoding chunked Vary Accept-Encoding Content-Type image/png Connection keep-alive
GET H3	200	myGov-cobranded-logo-white.svg easyair.co.zw/wp-content/mygov/app/login_files/	63 KB 20 KB	33ms 32ms	Image image/svg+xml	135.181.177.44 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://easyair.co.zw/wp-content/mygov/app/login_files/myGov-cobranded-logo-white.svg Requested by Host: easyair.co.zw URL: https://easyair.co.zw/wp-content/mygov/app/addcc.php Protocol H3 Security QUIC, , AES_128_GCM Server 135.181.177.44 Helsinki, Finland, ASN24940 (HETZNER-AS, DE), Reverse DNS myhost.nivacity.com Software LiteSpeed / Resource Hash 10b11a7c97b90bcf7ad520ac94c5769d08540ce1ee3b84d487c587bf128e3388 Request headers Referer https://easyair.co.zw/wp-content/mygov/app/addcc.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Tue, 09 Jul 2024 15:20:38 GMT content-encoding br last-modified Fri, 05 Jul 2024 22:30:55 GMT server LiteSpeed etag "fa8c-6688741f-1d413f9;br" vary Accept-Encoding content-type image/svg+xml cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 20312 expires Tue, 16 Jul 2024 15:20:38 GMT
GET H3	200	mgv2-vendor.js.download Show response easyair.co.zw/wp-content/mygov/app/login_files/	148 KB 149 KB	33ms 32ms	Script application/octet-stream	135.181.177.44 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://easyair.co.zw/wp-content/mygov/app/login_files/mgv2-vendor.js.download Requested by Host: easyair.co.zw URL: https://easyair.co.zw/wp-content/mygov/app/addcc.php Protocol H3 Security QUIC, , AES_128_GCM Server 135.181.177.44 Helsinki, Finland, ASN24940 (HETZNER-AS, DE), Reverse DNS myhost.nivacity.com Software LiteSpeed / Resource Hash 2bedda083bdbe6820e493159f1e3e27146b96ef6840094bd74447925e8c66e26 Request headers Referer https://easyair.co.zw/wp-content/mygov/app/addcc.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Tue, 09 Jul 2024 15:20:38 GMT last-modified Fri, 05 Jul 2024 22:30:55 GMT server LiteSpeed etag "251cf-6688741f-1d413f7;;;" content-type application/octet-stream accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 152015
GET H3	200	mgv2-application.js.download Show response easyair.co.zw/wp-content/mygov/app/login_files/	74 KB 74 KB	118ms 117ms	Script application/octet-stream	135.181.177.44 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://easyair.co.zw/wp-content/mygov/app/login_files/mgv2-application.js.download Requested by Host: easyair.co.zw URL: https://easyair.co.zw/wp-content/mygov/app/addcc.php Protocol H3 Security QUIC, , AES_128_GCM Server 135.181.177.44 Helsinki, Finland, ASN24940 (HETZNER-AS, DE), Reverse DNS myhost.nivacity.com Software LiteSpeed / Resource Hash 2c237ee02f34af672a7b889a44a32183f8558274bd727ff6d453062240c6d090 Request headers Referer https://easyair.co.zw/wp-content/mygov/app/addcc.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Tue, 09 Jul 2024 15:20:38 GMT last-modified Fri, 05 Jul 2024 22:30:55 GMT server LiteSpeed etag "12813-6688741f-1d413f6;;;" content-type application/octet-stream accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 75795
GET H3	200	login.js.download Show response easyair.co.zw/wp-content/mygov/app/login_files/	2 KB 2 KB	142ms 142ms	Script application/octet-stream	135.181.177.44 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://easyair.co.zw/wp-content/mygov/app/login_files/login.js.download Requested by Host: easyair.co.zw URL: https://easyair.co.zw/wp-content/mygov/app/addcc.php Protocol H3 Security QUIC, , AES_128_GCM Server 135.181.177.44 Helsinki, Finland, ASN24940 (HETZNER-AS, DE), Reverse DNS myhost.nivacity.com Software LiteSpeed / Resource Hash 3398bdeeb65157116e93bdeef72d320cb5d90700b149a62f60ff1dcb2ac8f9a5 Request headers Referer https://easyair.co.zw/wp-content/mygov/app/addcc.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Tue, 09 Jul 2024 15:20:38 GMT last-modified Fri, 05 Jul 2024 22:30:55 GMT server LiteSpeed etag "618-6688741f-1d413f4;;;" content-type application/octet-stream accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 1560
GET H2	200	KFOmCnqEu92Fr1Mu4mxK.woff2 fonts.gstatic.com/s/roboto/v30/	15 KB 16 KB	253ms 60ms	Font font/woff2	2a00:1450:4001:812::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 Requested by Host: easyair.co.zw URL: https://easyair.co.zw/wp-content/mygov/app/login_files/css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://easyair.co.zw/ Origin https://easyair.co.zw User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Tue, 09 Jul 2024 09:36:54 GMT x-content-type-options nosniff age 20624 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 15744 x-xss-protection 0 last-modified Wed, 11 May 2022 19:24:48 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 09 Jul 2025 09:36:54 GMT
GET H2	200	KFOlCnqEu92Fr1MmWUlfBBc4.woff2 fonts.gstatic.com/s/roboto/v30/	15 KB 16 KB	267ms 75ms	Font font/woff2	2a00:1450:4001:812::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 Requested by Host: easyair.co.zw URL: https://easyair.co.zw/wp-content/mygov/app/login_files/css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://easyair.co.zw/ Origin https://easyair.co.zw User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Tue, 09 Jul 2024 15:08:18 GMT x-content-type-options nosniff age 740 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 15860 x-xss-protection 0 last-modified Wed, 11 May 2022 19:24:42 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 09 Jul 2025 15:08:18 GMT
GET H2	200	KFOlCnqEu92Fr1MmEU9fBBc4.woff2 fonts.gstatic.com/s/roboto/v30/	16 KB 16 KB	317ms 125ms	Font font/woff2	2a00:1450:4001:812::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 Requested by Host: easyair.co.zw URL: https://easyair.co.zw/wp-content/mygov/app/login_files/css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://easyair.co.zw/ Origin https://easyair.co.zw User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Tue, 09 Jul 2024 09:53:01 GMT x-content-type-options nosniff age 19657 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 15920 x-xss-protection 0 last-modified Wed, 11 May 2022 19:24:45 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 09 Jul 2025 09:53:01 GMT
GET H3	404	M-myGov-Coloured%20Line.svg easyair.co.zw/wp-content/mygov/app/blugov/	146 B 146 B	233ms 232ms	Image text/html	135.181.177.44 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://easyair.co.zw/wp-content/mygov/app/blugov/M-myGov-Coloured%20Line.svg Requested by Host: easyair.co.zw URL: https://easyair.co.zw/wp-content/mygov/app/addcc.php Protocol H3 Security QUIC, , AES_128_GCM Server 135.181.177.44 Helsinki, Finland, ASN24940 (HETZNER-AS, DE), Reverse DNS myhost.nivacity.com Software LiteSpeed / Resource Hash 55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0 Request headers Referer https://easyair.co.zw/wp-content/mygov/app/addcc.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers pragma no-cache date Tue, 09 Jul 2024 15:20:38 GMT content-encoding gzip server LiteSpeed vary Accept-Encoding content-type text/html;charset=utf-8 cache-control no-store, no-cache, must-revalidate alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 106 expires Thu, 19 Nov 1981 08:52:00 GMT
GET H/1.1	200 OK	favicon-32x32.png login.my.gov.au/mygov/content/mgv2/icons/	360 B 1 KB	1702ms 343ms	Other image/png	161.146.235.204 CENTRELINK Depart...
General Check archive.org Show headers Download Go to Full URL https://login.my.gov.au/mygov/content/mgv2/icons/favicon-32x32.png Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 161.146.235.204 Canberra, Australia, ASN18055 (CENTRELINK Department of Human Services, AU), Reverse DNS Software / Resource Hash 72d85defa53d08b2e7976209ec80d86c3fd416b85bd1a78d79620217963acb3e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers Referer https://easyair.co.zw/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Tue, 09 Jul 2024 15:20:40 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff last-modified Sat, 22 Jun 2024 14:59:44 GMT vary Accept-Encoding x-frame-options DENY p3p CP="NON CUR OTPi OUR NOR UNI" content-type image/png cache-control max-age=3600,public,must-revalidate server-timing dtRpid;desc="675258206" accept-ranges bytes inst 1a content-length 360 x-xss-protection 1; mode=block expires Tue, 09 Jul 2024 16:20:40 GMT
POST H3	404	rb_6de8e2e9-6719-45b3-86be-7effcb9f6525 Show response easyair.co.zw/LoginServices/main/	146 B 147 B	238ms 236ms	XHR text/html	135.181.177.44 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://easyair.co.zw/LoginServices/main/rb_6de8e2e9-6719-45b3-86be-7effcb9f6525?type=js3&sn=v_4_srv_-2D63_sn_C4AQ8HNBO1BL683I0A5JJPBFS9622D8T&svrid=-63&flavor=post&vi=KRFWCOKIDAFPIKPKURNHHUBUAMHEMHRG-0&modifiedSince=1664408259780&rf=https%3A%2F%2Feasyair.co.zw%2Fwp-content%2Fmygov%2Fapp%2Faddcc.php&bp=3&app=5f15dc81410a75c1&crc=1019091818&en=gpalpirq&end=1 Requested by Host: easyair.co.zw URL: https://easyair.co.zw/wp-content/mygov/app/login_files/ruxitagentjs_ICA2Vfghjqrux_10243220606153550.js.download Protocol H3 Security QUIC, , AES_128_GCM Server 135.181.177.44 Helsinki, Finland, ASN24940 (HETZNER-AS, DE), Reverse DNS myhost.nivacity.com Software LiteSpeed / Resource Hash 55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0 Request headers Referer https://easyair.co.zw/wp-content/mygov/app/addcc.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers pragma no-cache date Tue, 09 Jul 2024 15:20:40 GMT content-encoding gzip server LiteSpeed vary Accept-Encoding content-type text/html;charset=utf-8 cache-control no-store, no-cache, must-revalidate alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 106 expires Thu, 19 Nov 1981 08:52:00 GMT
POST H3	404	rb_6de8e2e9-6719-45b3-86be-7effcb9f6525 Show response easyair.co.zw/LoginServices/main/	146 B 147 B	254ms 252ms	XHR text/html	135.181.177.44 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://easyair.co.zw/LoginServices/main/rb_6de8e2e9-6719-45b3-86be-7effcb9f6525?type=js3&sn=v_4_srv_-2D63_sn_C4AQ8HNBO1BL683I0A5JJPBFS9622D8T&svrid=-63&flavor=post&vi=KRFWCOKIDAFPIKPKURNHHUBUAMHEMHRG-0&modifiedSince=1664408259780&rf=https%3A%2F%2Feasyair.co.zw%2Fwp-content%2Fmygov%2Fapp%2Faddcc.php&bp=3&app=5f15dc81410a75c1&crc=940436994&en=gpalpirq&end=1 Requested by Host: easyair.co.zw URL: https://easyair.co.zw/wp-content/mygov/app/login_files/ruxitagentjs_ICA2Vfghjqrux_10243220606153550.js.download Protocol H3 Security QUIC, , AES_128_GCM Server 135.181.177.44 Helsinki, Finland, ASN24940 (HETZNER-AS, DE), Reverse DNS myhost.nivacity.com Software LiteSpeed / Resource Hash 55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0 Request headers Referer https://easyair.co.zw/wp-content/mygov/app/addcc.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers pragma no-cache date Tue, 09 Jul 2024 15:20:42 GMT content-encoding gzip server LiteSpeed vary Accept-Encoding content-type text/html;charset=utf-8 cache-control no-store, no-cache, must-revalidate alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 106 expires Thu, 19 Nov 1981 08:52:00 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Australian Government (Government)

83 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| dT_ object| dtrum function| $ function| moment function| cleanDefaultValues function| setMandatoryValues function| findInfoOrErrorParent function| findSuccessParent function| clearMessageType function| setErrorParent object| formHelper function| getGreetingTime function| initPinToggle function| setPinShow function| setPinHide string| titleBarTitle string| headingTitle function| getMobileHeader function| getDesktopHeader function| getAltText function| setAltText function| calcRightMargin function| insertDiv function| insertIframe function| determineContext function| insertIframeSrc function| setIFrameSrc function| sendGoogleAnalyltics function| addTimer function| disableBGScrolling function| enableBGScrolling function| toggleVAMobile function| addOnClickMobile function| isWindowMobile function| responsiveResize function| toggleVADesktop function| addOnClickDesktop function| addOnResize function| resizeVA function| addOnBackwardsTabbing function| loopFocusBackwardWithError function| addSkipToConversationTabListener function| addOnSkipToConversation function| addSkipToBot function| hideSkipToConversation function| skipToSkipToConversation function| skipToResizeIcon function| postMessageToIframe function| addListenerForIframe function| addDigitalAssistant function| scrollPageToBottom function| isIE function| newShowIdentityModal function| ignoreSubmit function| handleKeyboardInput function| trapFocusPrimary function| removeSelection function| trapFocusSecondary function| keyboardDismiss function| enableProgressButton function| summonSecondModal function| hideSecondaryModal function| harshHideIdentityModal function| fadeOutBackground function| newHideIdentityModal function| getToken function| isValidToken function| parseToken function| checkAuthenticated function| setDAsource function| recordBotInteraction function| initiateNewConversation object| storage function| isWebView object| global function| priorityLookup function| compareDates function| getTopAlert function| getTopBroadcast function| displayBroadcast function| formats function| numberValidation function| formatString

9 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			easyair.co.zw/	1969-12-31 23:59:59	Name: PHPSESSID Value: n8k1r38ui0rvb4v68o570g52a6
			.easyair.co.zw/	1969-12-31 23:59:59	Name: dtCookie Value: v_4_srv_-2D63_sn_C4AQ8HNBO1BL683I0A5JJPBFS9622D8T
			.easyair.co.zw/	1970-01-21 07:31:38	Name: rxVisitor Value: 172053843848287ME07CJ26RR2LVEE0REJ14G93QFN38V
			.easyair.co.zw/	1969-12-31 23:59:59	Name: dtLatC Value: 34
			.easyair.co.zw/	1969-12-31 23:59:59	Name: dtSa Value: -
			.easyair.co.zw/	1969-12-31 23:59:59	Name: rxvt Value: 1720540238944|1720538438484
			.easyair.co.zw/	1969-12-31 23:59:59	Name: dtPC Value: -63$338438480_147h-vKRFWCOKIDAFPIKPKURNHHUBUAMHEMHRG-0e0
			login.my.gov.au/	1970-01-20 21:55:40	Name: BIGipServerHBZK2i12N308Oa3l35yEhg Value: !ypVpN82Qc8jdiT2GbIznOHjqJgmvmxyns/L1xrQ/0CZdEuxbJ2OAaeiL1HbSdeC4MLsqNh3yhyMFhg==
			login.my.gov.au/	1969-12-31 23:59:59	Name: PD_STATEFUL_aaa1d6bc-31d2-11e6-b102-0050568e537f Value: %2Fmygov

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://easyair.co.zw/wp-content/mygov/app/blugov/M-myGov-Coloured%20Line.svg Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://easyair.co.zw/LoginServices/main/rb_6de8e2e9-6719-45b3-86be-7effcb9f6525?type=js3&sn=v_4_srv_-2D63_sn_C4AQ8HNBO1BL683I0A5JJPBFS9622D8T&svrid=-63&flavor=post&vi=KRFWCOKIDAFPIKPKURNHHUBUAMHEMHRG-0&modifiedSince=1664408259780&rf=https%3A%2F%2Feasyair.co.zw%2Fwp-content%2Fmygov%2Fapp%2Faddcc.php&bp=3&app=5f15dc81410a75c1&crc=1019091818&en=gpalpirq&end=1 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://easyair.co.zw/LoginServices/main/rb_6de8e2e9-6719-45b3-86be-7effcb9f6525?type=js3&sn=v_4_srv_-2D63_sn_C4AQ8HNBO1BL683I0A5JJPBFS9622D8T&svrid=-63&flavor=post&vi=KRFWCOKIDAFPIKPKURNHHUBUAMHEMHRG-0&modifiedSince=1664408259780&rf=https%3A%2F%2Feasyair.co.zw%2Fwp-content%2Fmygov%2Fapp%2Faddcc.php&bp=3&app=5f15dc81410a75c1&crc=940436994&en=gpalpirq&end=1 Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

easyair.co.zw
fonts.gstatic.com
login.my.gov.au
www.pngitem.com
135.181.177.44
161.146.235.204
204.12.226.4
2a00:1450:4001:812::2003
2a01:4f9:3a:1f18::2
00b399de3012a5f809a1fb531286f8cdb5e7671e865f0423a0ba0dfffcc8d9c5
10b11a7c97b90bcf7ad520ac94c5769d08540ce1ee3b84d487c587bf128e3388
2bedda083bdbe6820e493159f1e3e27146b96ef6840094bd74447925e8c66e26
2c237ee02f34af672a7b889a44a32183f8558274bd727ff6d453062240c6d090
3398bdeeb65157116e93bdeef72d320cb5d90700b149a62f60ff1dcb2ac8f9a5
551d6fdc92d330f73f7b1b18554fd619d72aa8e883f8192a05f6466049ae58b9
55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0
5ad45c3c8b9efc9e5427d60339eb9b65ffa97a501fe111fe373b100393acc405
72d85defa53d08b2e7976209ec80d86c3fd416b85bd1a78d79620217963acb3e
954aa858b3bffb8511bc41bc88b07d2b24597c37faf522550e26c9aa3b0d220d
a188842e336829593dd3f8b212b576bd9f08ac93bdc3e95fe32e6c1126dac318
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
e4b278f03b15d98341b6b1960e1b1d8c34dbd53cdec867348be0d728317ae756
ebc306a24f3d2b7e6a13d9e2d323f5fe903513d1afa8b2c75bf11e3a7c1f5ae8
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615