urlscan.io logo urlscan.io
SecurityTrails logo

onlineservices-view.com Open in urlscan Pro
104.21.42.11  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://onlineservices-view.com/ret/view
Submission: On March 29 via manual from AU — Scanned from AU
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 2 HTTP transactions. The main IP is 104.21.42.11, located in and belongs to CLOUDFLARENET, US. The main domain is onlineservices-view.com.
TLS certificate: Issued by GTS CA 1P5 on March 28th 2023. Valid for: 3 months.
This is the only time onlineservices-view.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Australian Government (Government)

Domain & IP information

IP Address AS Autonomous System
2 104.21.42.11 13335 (CLOUDFLAR...)
2 2
Apex Domain
Subdomains		 Transfer
2 onlineservices-view.com
onlineservices-view.com
161 KB
2 1
Domain Requested by
2 onlineservices-view.com onlineservices-view.com
2 1

This site contains links to these domains. Also see Links.

Domain
www.ato.gov.au
tap.status.ato.gov.au
www.mygovid.gov.au
info.authorisationmanager.gov.au
Subject Issuer Validity Valid
*.onlineservices-view.com
GTS CA 1P5		 2023-03-28 -
2023-06-26		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://onlineservices-view.com/ret/view
Frame ID: 65F2360BC8AA391F0DEF7931EFAD0B5E
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

myGov Verification

Detected technologies

Overall confidence: 100%
Detected patterns
  • <!-- (?:End )?Google Tag Manager -->

Page Statistics

2
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

246 kB
Transfer

520 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request view
onlineservices-view.com/ret/ 		402 KB
151 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://onlineservices-view.com/ret/view
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.42.11 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
524edd01dc796d280df5af5fe2da903e5c4124229701f1dd8b2cf83515a63a09

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language
en-AU,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
7afb259c1e3faabb-SYD
content-encoding
br
content-type
text/html; charset=UTF-8
date
Wed, 29 Mar 2023 21:18:43 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T2Wle0Z4oBZEkWaFs1SM4azvUmFzJSPPa54QNtRx0P5ELkIYPypeTtFAeHbQtyFPTluVyXAivz2qWaZ3zK%2Fr2ffX1KBxbIUcKJxQSBRCl6TTxtubPnXPfzUoBaRfLLKCf7T6TWres3XWeQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
logo_mygov.png
onlineservices-view.com/img/ 		10 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://onlineservices-view.com/img/logo_mygov.png
Requested by
Host: onlineservices-view.com
URL: https://onlineservices-view.com/ret/view
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.42.11 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
585a40899f4a1da0c58d8d50799542eb49de27fc1a8e61f2d305181e036b7b99

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://onlineservices-view.com/ret/view
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Wed, 29 Mar 2023 21:18:46 GMT
cf-cache-status
REVALIDATED
last-modified
Sun, 17 Jul 2022 10:27:10 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"28f3-5e3fdb1a27b80"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9n0MmqwK2JBLbDWy5GHvRLUjt%2FCNtqVMjh0MkcYXgcccYn4ZFUGSiuWjw4sSw08WiBIw1%2BIocDdu0Z1a2ii9cmLjXxXsvI5Ro9xk%2Fnxv03SLtkOIRMq4Gjb3%2BZpXX%2FtduZlHaU8BWO198g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
7afb25abac1baabb-SYD
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
10483
truncated
/ 		24 KB
24 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
914c2920b540ac8222f7bada2858386e7fd9343a205348df982fa0381887aa2f

Request headers

Referer
Origin
https://onlineservices-view.com
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Content-Type
font/x-woff
truncated
/ 		24 KB
24 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1e6b63c0a2a7834f6f4b185ee7a237040796bfd9e42b897c43ddd88e2ab198b6

Request headers

Referer
Origin
https://onlineservices-view.com
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Content-Type
font/x-woff
truncated
/ 		23 KB
23 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
86bd5cea62719e972ecb30a225da8dd26ac36abf36b4640e7107d2d23b112291

Request headers

Referer
Origin
https://onlineservices-view.com
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Content-Type
font/x-woff
truncated
/ 		14 KB
14 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5db45c35f0a84685c69793584dfd5419a8b9d8777524c74b383e9f69cbe3e433

Request headers

Referer
Origin
https://onlineservices-view.com
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Content-Type
font/x-woff
truncated
/ 		23 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0b33cca7a19f002f9b2cf940e735a40d6ba020eb937f9a422b0245d766906a8f

Request headers

accept-language
en-AU,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Australian Government (Government)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 boolean| credentialless function| savepage_ShadowLoader function| select

1 Cookies

Domain/Path Name / Value
onlineservices-view.com/ Name: PHPSESSID
Value: oumqss9u2qfnuddrbphp1a9hs1

1 Console Messages

Source Level URL
Text
other warning URL: https://onlineservices-view.com/ret/view(Line 59)
Message:
<link rel=preload> has an invalid `href` value