www.novitahealth.org.au Open in urlscan Pro
101.0.75.75  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request wp-info.php Show response www.novitahealth.org.au/order/	6 KB 3 KB	1322ms 444ms	Document text/html	101.0.75.75 HOSTOPIA-AU Hosto...
General Check archive.org Show headers Download Go to Full URL https://www.novitahealth.org.au/order/wp-info.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 101.0.75.75 , Australia, ASN55803 (HOSTOPIA-AU Hostopia Australia Web Pty Ltd, AU), Reverse DNS 75.75.0.101.static.digitalpacific.com.au Software Apache / Resource Hash 0496c63e26a57a52acb5370182cd2a7689e907e7b02cdbded8ac738451784ea4 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36 accept-language nl-NL,nl;q=0.9 Response headers cache-control no-store, no-cache, must-revalidate content-encoding gzip content-length 2425 content-type text/html; charset=UTF-8 date Mon, 25 Jul 2022 13:47:17 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server Apache vary Accept-Encoding,User-Agent
GET H/1.1	200 OK	CookieAuth.dll webmail.torstar.com/	78 KB 17 KB	2356ms 462ms	Stylesheet text/css	192.206.144.52 THETORONTOSTAR
General Check archive.org Show headers Download Go to Full URL https://webmail.torstar.com/CookieAuth.dll?GetPic?formdir=2&image=styles_responsive.css Requested by Host: www.novitahealth.org.au URL: https://www.novitahealth.org.au/order/wp-info.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 192.206.144.52 Concord, Canada, ASN10400 (THETORONTOSTAR, CA), Reverse DNS Software / Resource Hash e2edd1c0ce07b5199dca81995c0fb2a7d514c1ec8963c1f29c80b59c9de0e94e Request headers accept-language nl-NL,nl;q=0.9 Referer https://www.novitahealth.org.au/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36 Response headers Cache-control max-age=604800 Content-Encoding gzip Transfer-Encoding chunked Connection close Vary Accept-Encoding Content-Type text/css
GET H/1.1	200 OK	CookieAuth.dll Show response webmail.torstar.com/	18 KB 18 KB	2363ms 466ms	Script application/x-javascript	192.206.144.52 THETORONTOSTAR
General Check archive.org Show headers Download Go to Full URL https://webmail.torstar.com/CookieAuth.dll?GetPic?formdir=2&image=flogon.js Requested by Host: www.novitahealth.org.au URL: https://www.novitahealth.org.au/order/wp-info.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 192.206.144.52 Concord, Canada, ASN10400 (THETORONTOSTAR, CA), Reverse DNS Software / Resource Hash bf9a7d642c3575e7e97964c6879f2b0df69bbe506c78524b500ab8ae1fa288da Request headers accept-language nl-NL,nl;q=0.9 Referer https://www.novitahealth.org.au/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36 Response headers Cache-control max-age=604800 Connection close Content-Length 18740 Content-Type application/x-javascript
GET H/1.1	200 OK	CookieAuth.dll webmail.torstar.com/	2 KB 3 KB	455ms 454ms	Image image/png	192.206.144.52 THETORONTOSTAR
General Check archive.org Show headers Download Go to Show image Full URL https://webmail.torstar.com/CookieAuth.dll?GetPic?formdir=2&image=olk_logo_white.png Requested by Host: www.novitahealth.org.au URL: https://www.novitahealth.org.au/order/wp-info.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 192.206.144.52 Concord, Canada, ASN10400 (THETORONTOSTAR, CA), Reverse DNS Software / Resource Hash d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b Request headers accept-language nl-NL,nl;q=0.9 Referer https://www.novitahealth.org.au/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36 Response headers Connection close Cache-control max-age=604800 Content-Length 2503
GET H2	400	/ logo.clearbit.com/	0 0	304ms 201ms	Image text/plain	65.9.66.3 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://logo.clearbit.com/ Requested by Host: www.novitahealth.org.au URL: https://www.novitahealth.org.au/order/wp-info.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.9.66.3 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-65-9-66-3.fra56.r.cloudfront.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language nl-NL,nl;q=0.9 Referer https://www.novitahealth.org.au/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36 Response headers
GET		/ www./ Frame C882	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

www.

URL

https://www./

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

33 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| onld function| chkCookies function| ldCookie function| clkExp function| clkExp2 function| clkExp3 function| clkExp4 function| shw function| hd function| checkSubmit function| clkLgn function| clkSubmit function| clkLgn_new function| clkSec function| clkBsc function| clkChpwd function| optClkSec function| clkPin function| clkRtry function| gbid function| getUser number| a_fGzpEnbl number| g_fFcs function| window_onload

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.novitahealth.org.au/	1969-12-31 23:59:59	Name: PHPSESSID Value: e1c0f6788545e2023f1ba720b5aed4b2

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://logo.clearbit.com/ Message: Failed to load resource: the server responded with a status of 400 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

logo.clearbit.com
webmail.torstar.com
www.
www.novitahealth.org.au
www.
101.0.75.75
192.206.144.52
65.9.66.3
0496c63e26a57a52acb5370182cd2a7689e907e7b02cdbded8ac738451784ea4
bf9a7d642c3575e7e97964c6879f2b0df69bbe506c78524b500ab8ae1fa288da
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b
e2edd1c0ce07b5199dca81995c0fb2a7d514c1ec8963c1f29c80b59c9de0e94e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855