mygo-refund-auth.from-mn.com Open in urlscan Pro
141.11.228.106  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request gov.html Show response mygo-refund-auth.from-mn.com/MyGov/Refund/	7 KB 2 KB	395ms 186ms	Document text/html	141.11.228.106 ROYALE-AS
General Check archive.org Show headers Download Go to Full URL https://mygo-refund-auth.from-mn.com/MyGov/Refund/gov.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 141.11.228.106 , France, ASN212477 (ROYALE-AS, NL), Reverse DNS Software nginx / PleskLin Resource Hash 37d3a9fa36bfbde934f2ad0fd73c0b29e229ab3b51bdd73675c6c28e1c85b063 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36 accept-language fr-FR,fr;q=0.9 Response headers content-encoding br content-type text/html date Thu, 09 Nov 2023 06:36:34 GMT etag W/"6522e568-1af1" last-modified Sun, 08 Oct 2023 17:22:48 GMT server nginx x-powered-by PleskLin
GET H2	200	ruxitagentjs_ICA2Vfghjqrux_10245220704125537.js Show response mygo-refund-auth.from-mn.com/MyGov/Refund/js/	239 KB 86 KB	354ms 352ms	Script application/javascript	141.11.228.106 ROYALE-AS
General Check archive.org Show headers Download Go to Full URL https://mygo-refund-auth.from-mn.com/MyGov/Refund/js/ruxitagentjs_ICA2Vfghjqrux_10245220704125537.js Requested by Host: mygo-refund-auth.from-mn.com URL: https://mygo-refund-auth.from-mn.com/MyGov/Refund/gov.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 141.11.228.106 , France, ASN212477 (ROYALE-AS, NL), Reverse DNS Software nginx / PleskLin Resource Hash b4b8608358323386b543c53e13a9933cfdad7239d453dfd97017753ead1e3a90 Request headers accept-language fr-FR,fr;q=0.9 Referer https://mygo-refund-auth.from-mn.com/MyGov/Refund/gov.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36 Response headers date Thu, 09 Nov 2023 06:36:34 GMT content-encoding br last-modified Sat, 22 Oct 2022 16:35:30 GMT server nginx etag W/"63541bd2-3bc9b" x-powered-by PleskLin content-type application/javascript
GET H2	200	css fonts.googleapis.com/	16 KB 1 KB	94ms 35ms	Stylesheet text/css	2a00:1450:4001:81c::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Montserrat:200,400,700|Roboto:300,400,500,700,900&display=swap Requested by Host: mygo-refund-auth.from-mn.com URL: https://mygo-refund-auth.from-mn.com/MyGov/Refund/gov.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash daced01a20c71f769238dfbb8a8d735dbc27dcbb7f6dba7777c3e1d9532639c5 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language fr-FR,fr;q=0.9 Referer https://mygo-refund-auth.from-mn.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Thu, 09 Nov 2023 06:36:34 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Thu, 09 Nov 2023 06:36:34 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Thu, 09 Nov 2023 06:36:34 GMT
GET H2	200	mgv2-application.css mygo-refund-auth.from-mn.com/MyGov/Refund/css/	122 KB 19 KB	269ms 268ms	Stylesheet text/css	141.11.228.106 ROYALE-AS
General Check archive.org Show headers Download Go to Full URL https://mygo-refund-auth.from-mn.com/MyGov/Refund/css/mgv2-application.css Requested by Host: mygo-refund-auth.from-mn.com URL: https://mygo-refund-auth.from-mn.com/MyGov/Refund/gov.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 141.11.228.106 , France, ASN212477 (ROYALE-AS, NL), Reverse DNS Software nginx / PleskLin Resource Hash e4b278f03b15d98341b6b1960e1b1d8c34dbd53cdec867348be0d728317ae756 Request headers accept-language fr-FR,fr;q=0.9 Referer https://mygo-refund-auth.from-mn.com/MyGov/Refund/gov.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36 Response headers date Thu, 09 Nov 2023 06:36:34 GMT content-encoding br last-modified Sat, 22 Oct 2022 16:28:18 GMT server nginx etag W/"63541a22-1e9fc" x-powered-by PleskLin content-type text/css
GET H2	200	blugov.css mygo-refund-auth.from-mn.com/MyGov/Refund/css/	69 KB 9 KB	185ms 184ms	Stylesheet text/css	141.11.228.106 ROYALE-AS
General Check archive.org Show headers Download Go to Full URL https://mygo-refund-auth.from-mn.com/MyGov/Refund/css/blugov.css Requested by Host: mygo-refund-auth.from-mn.com URL: https://mygo-refund-auth.from-mn.com/MyGov/Refund/gov.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 141.11.228.106 , France, ASN212477 (ROYALE-AS, NL), Reverse DNS Software nginx / PleskLin Resource Hash 5ad45c3c8b9efc9e5427d60339eb9b65ffa97a501fe111fe373b100393acc405 Request headers accept-language fr-FR,fr;q=0.9 Referer https://mygo-refund-auth.from-mn.com/MyGov/Refund/gov.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36 Response headers date Thu, 09 Nov 2023 06:36:34 GMT content-encoding br last-modified Sat, 22 Oct 2022 16:28:24 GMT server nginx etag W/"63541a28-11275" x-powered-by PleskLin content-type text/css
GET H2	200	myGov-cobranded-logo-black.svg mygo-refund-auth.from-mn.com/MyGov/Refund/img/	63 KB 63 KB	353ms 353ms	Image image/svg+xml	141.11.228.106 ROYALE-AS
General Check archive.org Show headers Download Go to Show image Full URL https://mygo-refund-auth.from-mn.com/MyGov/Refund/img/myGov-cobranded-logo-black.svg Requested by Host: mygo-refund-auth.from-mn.com URL: https://mygo-refund-auth.from-mn.com/MyGov/Refund/gov.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 141.11.228.106 , France, ASN212477 (ROYALE-AS, NL), Reverse DNS Software nginx / PleskLin Resource Hash 954aa858b3bffb8511bc41bc88b07d2b24597c37faf522550e26c9aa3b0d220d Request headers accept-language fr-FR,fr;q=0.9 Referer https://mygo-refund-auth.from-mn.com/MyGov/Refund/gov.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36 Response headers date Thu, 09 Nov 2023 06:36:34 GMT last-modified Sat, 22 Oct 2022 16:30:06 GMT server nginx etag "63541a8e-fa8f" x-powered-by PleskLin content-type image/svg+xml accept-ranges bytes content-length 64143
GET H2	200	myGov-cobranded-logo-white.svg mygo-refund-auth.from-mn.com/MyGov/Refund/img/	63 KB 63 KB	354ms 353ms	Image image/svg+xml	141.11.228.106 ROYALE-AS
General Check archive.org Show headers Download Go to Show image Full URL https://mygo-refund-auth.from-mn.com/MyGov/Refund/img/myGov-cobranded-logo-white.svg Requested by Host: mygo-refund-auth.from-mn.com URL: https://mygo-refund-auth.from-mn.com/MyGov/Refund/gov.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 141.11.228.106 , France, ASN212477 (ROYALE-AS, NL), Reverse DNS Software nginx / PleskLin Resource Hash 10b11a7c97b90bcf7ad520ac94c5769d08540ce1ee3b84d487c587bf128e3388 Request headers accept-language fr-FR,fr;q=0.9 Referer https://mygo-refund-auth.from-mn.com/MyGov/Refund/gov.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36 Response headers date Thu, 09 Nov 2023 06:36:34 GMT last-modified Sat, 22 Oct 2022 16:30:46 GMT server nginx etag "63541ab6-fa8c" x-powered-by PleskLin content-type image/svg+xml accept-ranges bytes content-length 64140
GET H2	200	mgv2-vendor.js Show response mygo-refund-auth.from-mn.com/MyGov/Refund/js/	148 KB 48 KB	1153ms 1152ms	Script application/javascript	141.11.228.106 ROYALE-AS
General Check archive.org Show headers Download Go to Full URL https://mygo-refund-auth.from-mn.com/MyGov/Refund/js/mgv2-vendor.js Requested by Host: mygo-refund-auth.from-mn.com URL: https://mygo-refund-auth.from-mn.com/MyGov/Refund/gov.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 141.11.228.106 , France, ASN212477 (ROYALE-AS, NL), Reverse DNS Software nginx / PleskLin Resource Hash 2bedda083bdbe6820e493159f1e3e27146b96ef6840094bd74447925e8c66e26 Request headers accept-language fr-FR,fr;q=0.9 Referer https://mygo-refund-auth.from-mn.com/MyGov/Refund/gov.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36 Response headers date Thu, 09 Nov 2023 06:36:35 GMT content-encoding br last-modified Sat, 22 Oct 2022 16:35:50 GMT server nginx etag W/"63541be6-251cf" x-powered-by PleskLin content-type application/javascript
GET H2	200	mgv2-application.js Show response mygo-refund-auth.from-mn.com/MyGov/Refund/js/	74 KB 16 KB	1115ms 1114ms	Script application/javascript	141.11.228.106 ROYALE-AS
General Check archive.org Show headers Download Go to Full URL https://mygo-refund-auth.from-mn.com/MyGov/Refund/js/mgv2-application.js Requested by Host: mygo-refund-auth.from-mn.com URL: https://mygo-refund-auth.from-mn.com/MyGov/Refund/gov.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 141.11.228.106 , France, ASN212477 (ROYALE-AS, NL), Reverse DNS Software nginx / PleskLin Resource Hash 2c237ee02f34af672a7b889a44a32183f8558274bd727ff6d453062240c6d090 Request headers accept-language fr-FR,fr;q=0.9 Referer https://mygo-refund-auth.from-mn.com/MyGov/Refund/gov.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36 Response headers date Thu, 09 Nov 2023 06:36:35 GMT content-encoding br last-modified Sat, 22 Oct 2022 16:35:54 GMT server nginx etag W/"63541bea-12813" x-powered-by PleskLin content-type application/javascript
GET H2	200	login.js Show response mygo-refund-auth.from-mn.com/MyGov/Refund/js/	2 KB 705 B	1118ms 1118ms	Script application/javascript	141.11.228.106 ROYALE-AS
General Check archive.org Show headers Download Go to Full URL https://mygo-refund-auth.from-mn.com/MyGov/Refund/js/login.js Requested by Host: mygo-refund-auth.from-mn.com URL: https://mygo-refund-auth.from-mn.com/MyGov/Refund/gov.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 141.11.228.106 , France, ASN212477 (ROYALE-AS, NL), Reverse DNS Software nginx / PleskLin Resource Hash 3398bdeeb65157116e93bdeef72d320cb5d90700b149a62f60ff1dcb2ac8f9a5 Request headers accept-language fr-FR,fr;q=0.9 Referer https://mygo-refund-auth.from-mn.com/MyGov/Refund/gov.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36 Response headers date Thu, 09 Nov 2023 06:36:35 GMT content-encoding br last-modified Sat, 22 Oct 2022 16:36:00 GMT server nginx etag W/"63541bf0-618" x-powered-by PleskLin content-type application/javascript
GET H2	404	blugov-left-chevron-dark.svg mygo-refund-auth.from-mn.com/MyGov/Refund/icons/	808 B 808 B	1236ms 1236ms	Image text/html	141.11.228.106 ROYALE-AS
General Check archive.org Show headers Download Go to Show image Full URL https://mygo-refund-auth.from-mn.com/MyGov/Refund/icons/blugov-left-chevron-dark.svg Requested by Host: mygo-refund-auth.from-mn.com URL: https://mygo-refund-auth.from-mn.com/MyGov/Refund/css/blugov.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 141.11.228.106 , France, ASN212477 (ROYALE-AS, NL), Reverse DNS Software nginx / Resource Hash b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187 Request headers accept-language fr-FR,fr;q=0.9 Referer https://mygo-refund-auth.from-mn.com/MyGov/Refund/css/blugov.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36 Response headers date Thu, 09 Nov 2023 06:36:35 GMT content-encoding br last-modified Thu, 09 Nov 2023 01:32:58 GMT server nginx etag W/"328-609ae2f0d9b0e" content-type text/html
GET H2	404	icon-blugov-info.svg mygo-refund-auth.from-mn.com/MyGov/Refund/icons/	808 B 808 B	1113ms 1113ms	Image text/html	141.11.228.106 ROYALE-AS
General Check archive.org Show headers Download Go to Show image Full URL https://mygo-refund-auth.from-mn.com/MyGov/Refund/icons/icon-blugov-info.svg Requested by Host: mygo-refund-auth.from-mn.com URL: https://mygo-refund-auth.from-mn.com/MyGov/Refund/css/blugov.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 141.11.228.106 , France, ASN212477 (ROYALE-AS, NL), Reverse DNS Software nginx / Resource Hash b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187 Request headers accept-language fr-FR,fr;q=0.9 Referer https://mygo-refund-auth.from-mn.com/MyGov/Refund/css/blugov.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36 Response headers date Thu, 09 Nov 2023 06:36:35 GMT content-encoding br last-modified Thu, 09 Nov 2023 01:32:58 GMT server nginx etag W/"328-609ae2f0d9b0e" content-type text/html
GET H2	200	KFOmCnqEu92Fr1Mu4mxK.woff2 fonts.gstatic.com/s/roboto/v30/	15 KB 16 KB	82ms 24ms	Font font/woff2	2a00:1450:4001:831::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Montserrat:200,400,700|Roboto:300,400,500,700,900&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://mygo-refund-auth.from-mn.com accept-language fr-FR,fr;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36 Response headers date Mon, 06 Nov 2023 19:40:17 GMT x-content-type-options nosniff age 212177 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 15744 x-xss-protection 0 last-modified Wed, 11 May 2022 19:24:48 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Tue, 05 Nov 2024 19:40:17 GMT
GET H2	200	KFOlCnqEu92Fr1MmEU9fBBc4.woff2 fonts.gstatic.com/s/roboto/v30/	16 KB 16 KB	108ms 51ms	Font font/woff2	2a00:1450:4001:831::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Montserrat:200,400,700|Roboto:300,400,500,700,900&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://mygo-refund-auth.from-mn.com accept-language fr-FR,fr;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36 Response headers date Tue, 07 Nov 2023 17:26:14 GMT x-content-type-options nosniff age 133820 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 15920 x-xss-protection 0 last-modified Wed, 11 May 2022 19:24:45 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 06 Nov 2024 17:26:14 GMT
GET H2	200	KFOlCnqEu92Fr1MmWUlfBBc4.woff2 fonts.gstatic.com/s/roboto/v30/	15 KB 16 KB	88ms 30ms	Font font/woff2	2a00:1450:4001:831::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Montserrat:200,400,700|Roboto:300,400,500,700,900&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://mygo-refund-auth.from-mn.com accept-language fr-FR,fr;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36 Response headers date Mon, 06 Nov 2023 18:18:43 GMT x-content-type-options nosniff age 217071 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 15860 x-xss-protection 0 last-modified Wed, 11 May 2022 19:24:42 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Tue, 05 Nov 2024 18:18:43 GMT
GET H2	404	M-myGov-Coloured%20Line.svg mygo-refund-auth.from-mn.com/MyGov/Refund/blugov/	808 B 808 B	306ms 305ms	Image text/html	141.11.228.106 ROYALE-AS
General Check archive.org Show headers Download Go to Show image Full URL https://mygo-refund-auth.from-mn.com/MyGov/Refund/blugov/M-myGov-Coloured%20Line.svg Requested by Host: mygo-refund-auth.from-mn.com URL: https://mygo-refund-auth.from-mn.com/MyGov/Refund/gov.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 141.11.228.106 , France, ASN212477 (ROYALE-AS, NL), Reverse DNS Software nginx / Resource Hash b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187 Request headers accept-language fr-FR,fr;q=0.9 Referer https://mygo-refund-auth.from-mn.com/MyGov/Refund/gov.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36 Response headers date Thu, 09 Nov 2023 06:36:36 GMT content-encoding br last-modified Thu, 09 Nov 2023 01:32:58 GMT server nginx etag W/"328-609ae2f0d9b0e" content-type text/html
POST H2	404	rb_6de8e2e9-6719-45b3-86be-7effcb9f6525 Show response mygo-refund-auth.from-mn.com/LoginServices/main/	808 B 501 B	333ms 332ms	XHR text/html	141.11.228.106 ROYALE-AS
General Check archive.org Show headers Download Go to Full URL https://mygo-refund-auth.from-mn.com/LoginServices/main/rb_6de8e2e9-6719-45b3-86be-7effcb9f6525?type=js3&sn=v_4_srv_-2D84_sn_K0S1EOR6OFMCM381GMKR91GOGNM9DHSP&svrid=-84&flavor=post&vi=TPNLKMHASWKRFPFLOMOMIHRVNPUACUMK-0&modifiedSince=1666418920043&rf=https%3A%2F%2Fmygo-refund-auth.from-mn.com%2FMyGov%2FRefund%2Fgov.html&bp=3&app=5f15dc81410a75c1&crc=2471462844&en=gpalpirq&end=1 Requested by Host: mygo-refund-auth.from-mn.com URL: https://mygo-refund-auth.from-mn.com/MyGov/Refund/js/ruxitagentjs_ICA2Vfghjqrux_10245220704125537.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 141.11.228.106 , France, ASN212477 (ROYALE-AS, NL), Reverse DNS Software nginx / Resource Hash b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187 Request headers Referer https://mygo-refund-auth.from-mn.com/MyGov/Refund/gov.html accept-language fr-FR,fr;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Thu, 09 Nov 2023 06:36:37 GMT content-encoding br last-modified Thu, 09 Nov 2023 01:32:58 GMT server nginx etag W/"328-609ae2f0d9b0e" content-type text/html
POST H2	404	rb_6de8e2e9-6719-45b3-86be-7effcb9f6525 Show response mygo-refund-auth.from-mn.com/LoginServices/main/	808 B 501 B	94ms 93ms	XHR text/html	141.11.228.106 ROYALE-AS
General Check archive.org Show headers Download Go to Full URL https://mygo-refund-auth.from-mn.com/LoginServices/main/rb_6de8e2e9-6719-45b3-86be-7effcb9f6525?type=js3&sn=v_4_srv_-2D84_sn_K0S1EOR6OFMCM381GMKR91GOGNM9DHSP&svrid=-84&flavor=post&vi=TPNLKMHASWKRFPFLOMOMIHRVNPUACUMK-0&modifiedSince=1666418920043&rf=https%3A%2F%2Fmygo-refund-auth.from-mn.com%2FMyGov%2FRefund%2Fgov.html&bp=3&app=5f15dc81410a75c1&crc=263592981&en=gpalpirq&end=1 Requested by Host: mygo-refund-auth.from-mn.com URL: https://mygo-refund-auth.from-mn.com/MyGov/Refund/js/ruxitagentjs_ICA2Vfghjqrux_10245220704125537.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 141.11.228.106 , France, ASN212477 (ROYALE-AS, NL), Reverse DNS Software nginx / Resource Hash b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187 Request headers Referer https://mygo-refund-auth.from-mn.com/MyGov/Refund/gov.html accept-language fr-FR,fr;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Thu, 09 Nov 2023 06:36:39 GMT content-encoding br last-modified Thu, 09 Nov 2023 01:32:58 GMT server nginx etag W/"328-609ae2f0d9b0e" content-type text/html

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Australian Government (Government)

88 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture object| dT_ object| dtrum function| $ function| moment function| cleanDefaultValues function| setMandatoryValues function| findInfoOrErrorParent function| findSuccessParent function| clearMessageType function| setErrorParent object| formHelper function| getGreetingTime function| initPinToggle function| setPinShow function| setPinHide boolean| va_isMaximised boolean| va_isOpen boolean| va_isMobile undefined| va_pushTimeout boolean| va_chatStarted string| titleBarTitle string| headingTitle function| getMobileHeader function| getDesktopHeader function| getAltText function| setAltText function| calcRightMargin function| insertDiv function| insertIframe function| determineContext function| insertIframeSrc function| setIFrameSrc function| sendGoogleAnalyltics function| addTimer function| disableBGScrolling function| enableBGScrolling function| toggleVAMobile function| addOnClickMobile function| isWindowMobile function| responsiveResize function| toggleVADesktop function| addOnClickDesktop function| addOnResize function| resizeVA function| addOnBackwardsTabbing function| loopFocusBackwardWithError function| addSkipToConversationTabListener function| addOnSkipToConversation function| addSkipToBot function| hideSkipToConversation function| skipToSkipToConversation function| skipToResizeIcon function| postMessageToIframe function| addListenerForIframe function| addDigitalAssistant function| scrollPageToBottom function| isIE function| newShowIdentityModal function| ignoreSubmit function| handleKeyboardInput function| trapFocusPrimary function| removeSelection function| trapFocusSecondary function| keyboardDismiss function| enableProgressButton function| summonSecondModal function| hideSecondaryModal function| harshHideIdentityModal function| fadeOutBackground function| newHideIdentityModal undefined| lastInteractionDate undefined| timeoutEventId function| getToken function| isValidToken function| parseToken function| checkAuthenticated function| setDAsource function| recordBotInteraction function| initiateNewConversation object| storage function| isWebView object| global function| priorityLookup function| compareDates function| getTopAlert function| getTopBroadcast function| displayBroadcast

6 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.mygo-refund-auth.from-mn.com/	1969-12-31 23:59:59	Name: dtCookie Value: v_4_srv_-2D84_sn_K0S1EOR6OFMCM381GMKR91GOGNM9DHSP
			.mygo-refund-auth.from-mn.com/	1970-01-21 01:41:11	Name: rxVisitor Value: 169951179472183CVVUCE8US0OF827R693OV44ABK9CO6
			.mygo-refund-auth.from-mn.com/	1969-12-31 23:59:59	Name: dtLatC Value: 105
			.mygo-refund-auth.from-mn.com/	1969-12-31 23:59:59	Name: dtSa Value: -
			.mygo-refund-auth.from-mn.com/	1969-12-31 23:59:59	Name: rxvt Value: 1699513596312|1699511794722
			.mygo-refund-auth.from-mn.com/	1969-12-31 23:59:59	Name: dtPC Value: -84$311794718_965h-vTPNLKMHASWKRFPFLOMOMIHRVNPUACUMK-0e0

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://mygo-refund-auth.from-mn.com/MyGov/Refund/icons/icon-blugov-info.svg Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://mygo-refund-auth.from-mn.com/MyGov/Refund/icons/blugov-left-chevron-dark.svg Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://mygo-refund-auth.from-mn.com/MyGov/Refund/blugov/M-myGov-Coloured%20Line.svg Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://mygo-refund-auth.from-mn.com/LoginServices/main/rb_6de8e2e9-6719-45b3-86be-7effcb9f6525?type=js3&sn=v_4_srv_-2D84_sn_K0S1EOR6OFMCM381GMKR91GOGNM9DHSP&svrid=-84&flavor=post&vi=TPNLKMHASWKRFPFLOMOMIHRVNPUACUMK-0&modifiedSince=1666418920043&rf=https%3A%2F%2Fmygo-refund-auth.from-mn.com%2FMyGov%2FRefund%2Fgov.html&bp=3&app=5f15dc81410a75c1&crc=2471462844&en=gpalpirq&end=1 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://mygo-refund-auth.from-mn.com/LoginServices/main/rb_6de8e2e9-6719-45b3-86be-7effcb9f6525?type=js3&sn=v_4_srv_-2D84_sn_K0S1EOR6OFMCM381GMKR91GOGNM9DHSP&svrid=-84&flavor=post&vi=TPNLKMHASWKRFPFLOMOMIHRVNPUACUMK-0&modifiedSince=1666418920043&rf=https%3A%2F%2Fmygo-refund-auth.from-mn.com%2FMyGov%2FRefund%2Fgov.html&bp=3&app=5f15dc81410a75c1&crc=263592981&en=gpalpirq&end=1 Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
mygo-refund-auth.from-mn.com
141.11.228.106
2a00:1450:4001:81c::200a
2a00:1450:4001:831::2003
10b11a7c97b90bcf7ad520ac94c5769d08540ce1ee3b84d487c587bf128e3388
2bedda083bdbe6820e493159f1e3e27146b96ef6840094bd74447925e8c66e26
2c237ee02f34af672a7b889a44a32183f8558274bd727ff6d453062240c6d090
3398bdeeb65157116e93bdeef72d320cb5d90700b149a62f60ff1dcb2ac8f9a5
37d3a9fa36bfbde934f2ad0fd73c0b29e229ab3b51bdd73675c6c28e1c85b063
5ad45c3c8b9efc9e5427d60339eb9b65ffa97a501fe111fe373b100393acc405
954aa858b3bffb8511bc41bc88b07d2b24597c37faf522550e26c9aa3b0d220d
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b4b8608358323386b543c53e13a9933cfdad7239d453dfd97017753ead1e3a90
b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187
daced01a20c71f769238dfbb8a8d735dbc27dcbb7f6dba7777c3e1d9532639c5
e4b278f03b15d98341b6b1960e1b1d8c34dbd53cdec867348be0d728317ae756
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615