www.inland.revenue.nz-govt.letrasparainstagram.com Open in urlscan Pro
5.145.175.80 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.inland.revenue.nz-govt.letrasparainstagram.com/
Submission: On April 17 via automatic, source certstream-suspicious (April 17th 2020, 7:37:15 pm UTC)

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 10 HTTP transactions. The main IP is 5.145.175.80, located in Spain and belongs to COMVIVE-AS Seville - Spain, ES. The main domain is www.inland.revenue.nz-govt.letrasparainstagram.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on April 17th 2020. Valid for: 3 months.

This is the only time www.inland.revenue.nz-govt.letrasparainstagram.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: NZ Government (Government)

Domain & IP information

	IP Address	AS Autonomous System
9	5.145.175.80 5.145.175.80	39020 (COMVIVE-A...) (COMVIVE-AS Seville - Spain)
1	222.153.202.43 222.153.202.43	4771 (SPARKNZ S...) (SPARKNZ Spark New Zealand Trading Ltd.)
10	2

9 5.145.175.80 (Spain)

ASN39020 (COMVIVE-AS Seville - Spain, ES)
PTR: cp80.zonasprivadasdns.com

www.inland.revenue.nz-govt.letrasparainstagram.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 222.153.202.43 (Auckland, New Zealand)

ASN4771 (SPARKNZ Spark New Zealand Trading Ltd., NZ)

services.ird.govt.nz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	letrasparainstagram.com www.inland.revenue.nz-govt.letrasparainstagram.com	72 KB
1	ird.govt.nz services.ird.govt.nz	5 KB
10	2

	Domain	Requested by
9	www.inland.revenue.nz-govt.letrasparainstagram.com	www.inland.revenue.nz-govt.letrasparainstagram.com
1	services.ird.govt.nz	www.inland.revenue.nz-govt.letrasparainstagram.com
10	2

This site contains no links.

Subject Issuer	Validity	Valid
inland.revenue.nz-govt.letrasparainstagram.com Let's Encrypt Authority X3	`2020-04-17` - `2020-07-16`	3 months	crt.sh
myir.ird.govt.nz DigiCert SHA2 Extended Validation Server CA	`2019-03-18` - `2021-05-05`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://www.inland.revenue.nz-govt.letrasparainstagram.com/
Frame ID: D075B988234D627F112F3DCD563F26A5
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i

LiteSpeed (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^LiteSpeed$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

78 kB
Transfer

345 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.inland.revenue.nz-govt.letrasparainstagram.com/	4 KB 1 KB	396ms 50ms	Document text/html	5.145.175.80 Spain
General Check archive.org Show headers Download Go to Full URL https://www.inland.revenue.nz-govt.letrasparainstagram.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 5.145.175.80 , Spain, ASN39020 (COMVIVE-AS Seville - Spain, ES), Reverse DNS cp80.zonasprivadasdns.com Software LiteSpeed / Resource Hash `90a5717f249f41aee8ca19f7cc08dc68c3545bacc91db13e624e62880b58f7b0` Request headers :method GET :authority www.inland.revenue.nz-govt.letrasparainstagram.com :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers status 200 content-type text/html last-modified Thu, 16 Apr 2020 21:23:55 GMT accept-ranges bytes content-encoding br vary Accept-Encoding content-length 1156 date Fri, 17 Apr 2020 19:36:52 GMT server LiteSpeed alt-svc quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-24=":443"; ma=2592000, h3-25=":443"; ma=2592000
GET H2	200	bootstrap.css www.inland.revenue.nz-govt.letrasparainstagram.com/dev/	170 KB 20 KB	48ms 46ms	Stylesheet text/css	5.145.175.80 Spain
General Check archive.org Show headers Download Go to Full URL https://www.inland.revenue.nz-govt.letrasparainstagram.com/dev/bootstrap.css Requested by Host: www.inland.revenue.nz-govt.letrasparainstagram.com URL: https://www.inland.revenue.nz-govt.letrasparainstagram.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 5.145.175.80 , Spain, ASN39020 (COMVIVE-AS Seville - Spain, ES), Reverse DNS cp80.zonasprivadasdns.com Software LiteSpeed / Resource Hash `7bce1816c1a043accc42ee2a38bf2a76db546095ccb1bb6238a2ef0c4aab5a73` Request headers Referer https://www.inland.revenue.nz-govt.letrasparainstagram.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 17 Apr 2020 19:36:52 GMT content-encoding br last-modified Mon, 24 Feb 2020 08:35:10 GMT server LiteSpeed vary Accept-Encoding content-type text/css status 200 cache-control public, max-age=604800 accept-ranges bytes content-length 20848 expires Fri, 24 Apr 2020 19:36:52 GMT
GET H2	200	login-base.css www.inland.revenue.nz-govt.letrasparainstagram.com/dev/	15 KB 3 KB	85ms 84ms	Stylesheet text/css	5.145.175.80 Spain
General Check archive.org Show headers Download Go to Full URL https://www.inland.revenue.nz-govt.letrasparainstagram.com/dev/login-base.css Requested by Host: www.inland.revenue.nz-govt.letrasparainstagram.com URL: https://www.inland.revenue.nz-govt.letrasparainstagram.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 5.145.175.80 , Spain, ASN39020 (COMVIVE-AS Seville - Spain, ES), Reverse DNS cp80.zonasprivadasdns.com Software LiteSpeed / Resource Hash `6329fd443cca71e3a277dde01700f5dffcb71cdf4ac4ee8840627933ce8167ba` Request headers Referer https://www.inland.revenue.nz-govt.letrasparainstagram.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 17 Apr 2020 19:36:52 GMT content-encoding br last-modified Mon, 24 Feb 2020 08:35:10 GMT server LiteSpeed vary Accept-Encoding content-type text/css status 200 cache-control public, max-age=604800 accept-ranges bytes content-length 3038 expires Fri, 24 Apr 2020 19:36:52 GMT
GET H2	200	login-sm.css www.inland.revenue.nz-govt.letrasparainstagram.com/dev/	4 KB 1 KB	85ms 84ms	Stylesheet text/css	5.145.175.80 Spain
General Check archive.org Show headers Download Go to Full URL https://www.inland.revenue.nz-govt.letrasparainstagram.com/dev/login-sm.css Requested by Host: www.inland.revenue.nz-govt.letrasparainstagram.com URL: https://www.inland.revenue.nz-govt.letrasparainstagram.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 5.145.175.80 , Spain, ASN39020 (COMVIVE-AS Seville - Spain, ES), Reverse DNS cp80.zonasprivadasdns.com Software LiteSpeed / Resource Hash `17b96e6d03aba2594e49eb8fe8221db23b2bb66a3b7617fafdec0a357a73e468` Request headers Referer https://www.inland.revenue.nz-govt.letrasparainstagram.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 17 Apr 2020 19:36:52 GMT content-encoding br last-modified Mon, 24 Feb 2020 08:35:10 GMT server LiteSpeed vary Accept-Encoding content-type text/css status 200 cache-control public, max-age=604800 accept-ranges bytes content-length 993 expires Fri, 24 Apr 2020 19:36:52 GMT
GET H2	200	login-md.css www.inland.revenue.nz-govt.letrasparainstagram.com/dev/	4 KB 1 KB	86ms 85ms	Stylesheet text/css	5.145.175.80 Spain
General Check archive.org Show headers Download Go to Full URL https://www.inland.revenue.nz-govt.letrasparainstagram.com/dev/login-md.css Requested by Host: www.inland.revenue.nz-govt.letrasparainstagram.com URL: https://www.inland.revenue.nz-govt.letrasparainstagram.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 5.145.175.80 , Spain, ASN39020 (COMVIVE-AS Seville - Spain, ES), Reverse DNS cp80.zonasprivadasdns.com Software LiteSpeed / Resource Hash `e3540248ae0c8f518d0664eca5a882f7381e89b7e840abcdfb228d58d93d1449` Request headers Referer https://www.inland.revenue.nz-govt.letrasparainstagram.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 17 Apr 2020 19:36:52 GMT content-encoding br last-modified Mon, 24 Feb 2020 08:35:10 GMT server LiteSpeed vary Accept-Encoding content-type text/css status 200 cache-control public, max-age=604800 accept-ranges bytes content-length 1087 expires Fri, 24 Apr 2020 19:36:52 GMT
GET H2	200	login-lg.css www.inland.revenue.nz-govt.letrasparainstagram.com/dev/	4 KB 1 KB	86ms 85ms	Stylesheet text/css	5.145.175.80 Spain
General Check archive.org Show headers Download Go to Full URL https://www.inland.revenue.nz-govt.letrasparainstagram.com/dev/login-lg.css Requested by Host: www.inland.revenue.nz-govt.letrasparainstagram.com URL: https://www.inland.revenue.nz-govt.letrasparainstagram.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 5.145.175.80 , Spain, ASN39020 (COMVIVE-AS Seville - Spain, ES), Reverse DNS cp80.zonasprivadasdns.com Software LiteSpeed / Resource Hash `928003200786af6e466683e2576f23c3d888d86135dbdbde4dccfdf15a95cd2d` Request headers Referer https://www.inland.revenue.nz-govt.letrasparainstagram.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 17 Apr 2020 19:36:52 GMT content-encoding br last-modified Mon, 24 Feb 2020 08:35:10 GMT server LiteSpeed vary Accept-Encoding content-type text/css status 200 cache-control public, max-age=604800 accept-ranges bytes content-length 1079 expires Fri, 24 Apr 2020 19:36:52 GMT
GET H/1.1	200 OK	logo-myir-lg.png services.ird.govt.nz/irsso/resources/img/	5 KB 5 KB	3597ms 358ms	Image image/png	222.153.202.43 SPARKNZ Spark New...
General Check archive.org Show headers Download Go to Show image Full URL https://services.ird.govt.nz/irsso/resources/img/logo-myir-lg.png Requested by Host: www.inland.revenue.nz-govt.letrasparainstagram.com URL: https://www.inland.revenue.nz-govt.letrasparainstagram.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_CBC Server 222.153.202.43 Auckland, New Zealand, ASN4771 (SPARKNZ Spark New Zealand Trading Ltd., NZ), Reverse DNS Software / Resource Hash `a867943372f6f7a9ad62e54eef1fc0116dea05e68873c9b886cc0ba05cd0ec2b` Request headers Referer https://www.inland.revenue.nz-govt.letrasparainstagram.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 17 Apr 2020 19:36:56 GMT Last-Modified Fri, 17 Apr 2020 00:55:14 GMT Content-Language en Connection Keep-Alive Accept-Ranges bytes Content-Type image/png Keep-Alive timeout=31, max=100 Content-Length 4823
GET H2	200	New_Zealand_Government_logo.svg www.inland.revenue.nz-govt.letrasparainstagram.com/dev/	6 KB 2 KB	152ms 151ms	Image image/svg+xml	5.145.175.80 Spain
General Check archive.org Show headers Download Go to Show image Full URL https://www.inland.revenue.nz-govt.letrasparainstagram.com/dev/New_Zealand_Government_logo.svg Requested by Host: www.inland.revenue.nz-govt.letrasparainstagram.com URL: https://www.inland.revenue.nz-govt.letrasparainstagram.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 5.145.175.80 , Spain, ASN39020 (COMVIVE-AS Seville - Spain, ES), Reverse DNS cp80.zonasprivadasdns.com Software LiteSpeed / Resource Hash `4d407be54018aec8b0377456de982568ba3e889643af298bc411a306f089562f` Request headers Referer https://www.inland.revenue.nz-govt.letrasparainstagram.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 17 Apr 2020 19:36:52 GMT content-encoding br last-modified Mon, 24 Feb 2020 08:35:10 GMT server LiteSpeed vary Accept-Encoding content-type image/svg+xml status 200 cache-control public, max-age=604800 accept-ranges bytes content-length 2195 expires Fri, 24 Apr 2020 19:36:52 GMT
GET H2	200	jquery-3.3.1.min.js Show response www.inland.revenue.nz-govt.letrasparainstagram.com/dev/	85 KB 29 KB	86ms 85ms	Script application/javascript	5.145.175.80 Spain
General Check archive.org Show headers Download Go to Full URL https://www.inland.revenue.nz-govt.letrasparainstagram.com/dev/jquery-3.3.1.min.js Requested by Host: www.inland.revenue.nz-govt.letrasparainstagram.com URL: https://www.inland.revenue.nz-govt.letrasparainstagram.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 5.145.175.80 , Spain, ASN39020 (COMVIVE-AS Seville - Spain, ES), Reverse DNS cp80.zonasprivadasdns.com Software LiteSpeed / Resource Hash `160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef` Request headers Referer https://www.inland.revenue.nz-govt.letrasparainstagram.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 17 Apr 2020 19:36:52 GMT content-encoding br last-modified Mon, 24 Feb 2020 08:35:10 GMT server LiteSpeed vary Accept-Encoding content-type application/javascript status 200 cache-control public, max-age=604800 accept-ranges bytes content-length 29664 expires Fri, 24 Apr 2020 19:36:52 GMT
GET H2	200	bootstrap.min.js Show response www.inland.revenue.nz-govt.letrasparainstagram.com/dev/	50 KB 13 KB	121ms 120ms	Script application/javascript	5.145.175.80 Spain
General Check archive.org Show headers Download Go to Full URL https://www.inland.revenue.nz-govt.letrasparainstagram.com/dev/bootstrap.min.js Requested by Host: www.inland.revenue.nz-govt.letrasparainstagram.com URL: https://www.inland.revenue.nz-govt.letrasparainstagram.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 5.145.175.80 , Spain, ASN39020 (COMVIVE-AS Seville - Spain, ES), Reverse DNS cp80.zonasprivadasdns.com Software LiteSpeed / Resource Hash `8713b8c06dbd3b459163d11eef03ef255e09013d8b4bf89b840a5ea411a52753` Request headers Referer https://www.inland.revenue.nz-govt.letrasparainstagram.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 17 Apr 2020 19:36:52 GMT content-encoding br last-modified Mon, 24 Feb 2020 08:35:10 GMT server LiteSpeed vary Accept-Encoding content-type application/javascript status 200 cache-control public, max-age=604800 accept-ranges bytes content-length 13400 expires Fri, 24 Apr 2020 19:36:52 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: NZ Government (Government)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

services.ird.govt.nz
www.inland.revenue.nz-govt.letrasparainstagram.com
222.153.202.43
5.145.175.80
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
17b96e6d03aba2594e49eb8fe8221db23b2bb66a3b7617fafdec0a357a73e468
4d407be54018aec8b0377456de982568ba3e889643af298bc411a306f089562f
6329fd443cca71e3a277dde01700f5dffcb71cdf4ac4ee8840627933ce8167ba
7bce1816c1a043accc42ee2a38bf2a76db546095ccb1bb6238a2ef0c4aab5a73
8713b8c06dbd3b459163d11eef03ef255e09013d8b4bf89b840a5ea411a52753
90a5717f249f41aee8ca19f7cc08dc68c3545bacc91db13e624e62880b58f7b0
928003200786af6e466683e2576f23c3d888d86135dbdbde4dccfdf15a95cd2d
a867943372f6f7a9ad62e54eef1fc0116dea05e68873c9b886cc0ba05cd0ec2b
e3540248ae0c8f518d0664eca5a882f7381e89b7e840abcdfb228d58d93d1449

www.inland.revenue.nz-govt.letrasparainstagram.com Open in urlscan Pro 5.145.175.80 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

10 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

78 kBTransfer

345 kBSize

0 Cookies

0 Outgoing links

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

0 Cookies

Indicators

www.inland.revenue.nz-govt.letrasparainstagram.com Open in urlscan Pro
5.145.175.80 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

78 kB
Transfer

345 kB
Size

0
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!