returncalculation.calcuttaclub.org Open in urlscan Pro
195.250.21.207 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://olleagi.com/sedrik
Effective URL:
https://returncalculation.calcuttaclub.org/KINDL/KDOELD/web.php
Submission: On November 13 via api (November 13th 2024, 3:28:27 am UTC) from AU — Scanned from AU

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 2 countries across 2 domains to perform 9 HTTP transactions. The main IP is 195.250.21.207, located in United Kingdom and belongs to WHG-IN, GB. The main domain is returncalculation.calcuttaclub.org.
TLS certificate: Issued by R11 on October 13th 2024. Valid for: 3 months.

This is the only time returncalculation.calcuttaclub.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Australian Government (Government)

Domain & IP information

	IP Address	AS Autonomous System
2 2	2a00:4b40:aaa... 2a00:4b40:aaaa:2001::5	51013 (WEBSUPPOR...) (WEBSUPPORT-SRO-SK-AS)
1 10	195.250.21.207 195.250.21.207	199404 (WHG-IN) (WHG-IN)
9	1

2 2a00:4b40:aaaa:2001::5 (Slovakia) 2 redirects

ASN51013 (WEBSUPPORT-SRO-SK-AS, SK)

olleagi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 195.250.21.207 (United Kingdom) 1 redirects

ASN199404 (WHG-IN, GB)
PTR: 604755-calcuttaclub.securehostdns.com

returncalculation.calcuttaclub.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	calcuttaclub.org 1 redirects returncalculation.calcuttaclub.org	330 KB
2	olleagi.com 2 redirects olleagi.com	631 B
9	2

	Domain	Requested by
10	returncalculation.calcuttaclub.org	1 redirects returncalculation.calcuttaclub.org
2	olleagi.com	2 redirects
9	2

This site contains no links.

Subject Issuer	Validity	Valid
returncalculation.calcuttaclub.org R11	`2024-10-13` - `2025-01-11`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://returncalculation.calcuttaclub.org/KINDL/KDOELD/web.php
Frame ID: 1CC5C518B522E186B0E5F6B7CFB2FE13
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in with myGov - myGov

Page URL History Show full URLs

https://olleagi.com/sedrik HTTP 301
https://olleagi.com/sedrik/ HTTP 302
https://returncalculation.calcuttaclub.org/KINDL/KDOELD/ HTTP 302
https://returncalculation.calcuttaclub.org/KINDL/KDOELD/web.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

9
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

329 kB
Transfer

329 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://olleagi.com/sedrik HTTP 301
https://olleagi.com/sedrik/ HTTP 302
https://returncalculation.calcuttaclub.org/KINDL/KDOELD/ HTTP 302
https://returncalculation.calcuttaclub.org/KINDL/KDOELD/web.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request web.php Show response returncalculation.calcuttaclub.org/KINDL/KDOELD/ Redirect Chain https://olleagi.com/sedrik https://olleagi.com/sedrik/ https://returncalculation.calcuttaclub.org/KINDL/KDOELD/ https://returncalculation.calcuttaclub.org/KINDL/KDOELD/web.php	6 KB 6 KB	160ms 160ms	Document text/html	195.250.21.207 WHG-IN
General Check archive.org Show headers Download Go to Full URL https://returncalculation.calcuttaclub.org/KINDL/KDOELD/web.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 195.250.21.207 , United Kingdom, ASN199404 (WHG-IN, GB), Reverse DNS 604755-calcuttaclub.securehostdns.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `b7c93698aa2ef89c0b9109af249fcb922fca9ada8e087e4a0a7be53034d888fb` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers content-encoding gzip content-length 6588 content-type text/html; charset=UTF-8 date Wed, 13 Nov 2024 03:28:20 GMT server Microsoft-IIS/10.0 vary Accept-Encoding x-powered-by ASP.NET x-powered-by-plesk PleskWin Redirect headers content-length 0 content-type text/html; charset=UTF-8 date Wed, 13 Nov 2024 03:28:20 GMT location ./web.php server Microsoft-IIS/10.0 x-powered-by ASP.NET x-powered-by-plesk PleskWin
GET H2	404	css returncalculation.calcuttaclub.org/KINDL/KDOELD/files/	0 0	487ms 486ms	Stylesheet text/html	195.250.21.207 WHG-IN
General Check archive.org Show headers Download Go to Full URL https://returncalculation.calcuttaclub.org/KINDL/KDOELD/files/css Requested by Host: returncalculation.calcuttaclub.org URL: https://returncalculation.calcuttaclub.org/KINDL/KDOELD/web.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 195.250.21.207 , United Kingdom, ASN199404 (WHG-IN, GB), Reverse DNS 604755-calcuttaclub.securehostdns.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://returncalculation.calcuttaclub.org/KINDL/KDOELD/web.php Response headers x-powered-by-plesk PleskWin cache-control private content-length 4621 date Wed, 13 Nov 2024 03:28:20 GMT content-type text/html; charset=utf-8 x-powered-by ASP.NET server Microsoft-IIS/10.0
GET H2	200	mgv2-application.css returncalculation.calcuttaclub.org/KINDL/KDOELD/files/	123 KB 123 KB	484ms 483ms	Stylesheet text/css	195.250.21.207 WHG-IN
General Check archive.org Show headers Download Go to Full URL https://returncalculation.calcuttaclub.org/KINDL/KDOELD/files/mgv2-application.css Requested by Host: returncalculation.calcuttaclub.org URL: https://returncalculation.calcuttaclub.org/KINDL/KDOELD/web.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 195.250.21.207 , United Kingdom, ASN199404 (WHG-IN, GB), Reverse DNS 604755-calcuttaclub.securehostdns.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `6b029a47a7bb72e8b70cf436b83d904b8a366fd360d12b4d8917c9f59e4b7d46` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://returncalculation.calcuttaclub.org/KINDL/KDOELD/web.php Response headers content-encoding gzip etag "08d9b8cb9bd91:0" accept-ranges bytes x-powered-by-plesk PleskWin date Wed, 13 Nov 2024 03:28:20 GMT content-type text/css last-modified Fri, 09 Dec 2022 10:32:34 GMT vary Accept-Encoding server Microsoft-IIS/10.0 x-powered-by ASP.NET
GET H2	200	blugov.css returncalculation.calcuttaclub.org/KINDL/KDOELD/files/	69 KB 69 KB	171ms 170ms	Stylesheet text/css	195.250.21.207 WHG-IN
General Check archive.org Show headers Download Go to Full URL https://returncalculation.calcuttaclub.org/KINDL/KDOELD/files/blugov.css Requested by Host: returncalculation.calcuttaclub.org URL: https://returncalculation.calcuttaclub.org/KINDL/KDOELD/web.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 195.250.21.207 , United Kingdom, ASN199404 (WHG-IN, GB), Reverse DNS 604755-calcuttaclub.securehostdns.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `ca72017bbc6457c0fadb84afe2d0657e7a6d2455d8a1def279221c12ed892c3a` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://returncalculation.calcuttaclub.org/KINDL/KDOELD/web.php Response headers content-encoding gzip etag "078fbf1d1bd91:0" accept-ranges bytes x-powered-by-plesk PleskWin date Wed, 13 Nov 2024 03:28:20 GMT content-type text/css last-modified Fri, 09 Dec 2022 13:27:12 GMT vary Accept-Encoding server Microsoft-IIS/10.0 x-powered-by ASP.NET
GET H2	200	myGov-cobranded-logo-black.svg returncalculation.calcuttaclub.org/KINDL/KDOELD/files/	63 KB 63 KB	643ms 642ms	Image image/svg+xml	195.250.21.207 WHG-IN
General Check archive.org Show headers Download Go to Show image Full URL https://returncalculation.calcuttaclub.org/KINDL/KDOELD/files/myGov-cobranded-logo-black.svg Requested by Host: returncalculation.calcuttaclub.org URL: https://returncalculation.calcuttaclub.org/KINDL/KDOELD/web.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 195.250.21.207 , United Kingdom, ASN199404 (WHG-IN, GB), Reverse DNS 604755-calcuttaclub.securehostdns.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `954aa858b3bffb8511bc41bc88b07d2b24597c37faf522550e26c9aa3b0d220d` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://returncalculation.calcuttaclub.org/KINDL/KDOELD/web.php Response headers etag "08d9b8cb9bd91:0" accept-ranges bytes x-powered-by-plesk PleskWin content-length 64143 date Wed, 13 Nov 2024 03:28:20 GMT content-type image/svg+xml last-modified Fri, 09 Dec 2022 10:32:34 GMT server Microsoft-IIS/10.0 x-powered-by ASP.NET
GET H2	200	myGov-cobranded-logo-white.svg returncalculation.calcuttaclub.org/KINDL/KDOELD/files/	63 KB 63 KB	644ms 644ms	Image image/svg+xml	195.250.21.207 WHG-IN
General Check archive.org Show headers Download Go to Show image Full URL https://returncalculation.calcuttaclub.org/KINDL/KDOELD/files/myGov-cobranded-logo-white.svg Requested by Host: returncalculation.calcuttaclub.org URL: https://returncalculation.calcuttaclub.org/KINDL/KDOELD/web.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 195.250.21.207 , United Kingdom, ASN199404 (WHG-IN, GB), Reverse DNS 604755-calcuttaclub.securehostdns.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `10b11a7c97b90bcf7ad520ac94c5769d08540ce1ee3b84d487c587bf128e3388` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://returncalculation.calcuttaclub.org/KINDL/KDOELD/web.php Response headers etag "08d9b8cb9bd91:0" accept-ranges bytes x-powered-by-plesk PleskWin content-length 64140 date Wed, 13 Nov 2024 03:28:20 GMT content-type image/svg+xml last-modified Fri, 09 Dec 2022 10:32:34 GMT server Microsoft-IIS/10.0 x-powered-by ASP.NET
GET H2	200	blugov-left-chevron-dark.svg returncalculation.calcuttaclub.org/KINDL/KDOELD/files/	256 B 358 B	160ms 159ms	Image image/svg+xml	195.250.21.207 WHG-IN
General Check archive.org Show headers Download Go to Show image Full URL https://returncalculation.calcuttaclub.org/KINDL/KDOELD/files/blugov-left-chevron-dark.svg Requested by Host: returncalculation.calcuttaclub.org URL: https://returncalculation.calcuttaclub.org/KINDL/KDOELD/files/blugov.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 195.250.21.207 , United Kingdom, ASN199404 (WHG-IN, GB), Reverse DNS 604755-calcuttaclub.securehostdns.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `af454d272466fa84c77ca8028e0b8b8bcc0a193ad4401dfcddbad07dc2dabcfc` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://returncalculation.calcuttaclub.org/KINDL/KDOELD/files/blugov.css Response headers etag "089dee4d1bd91:0" accept-ranges bytes x-powered-by-plesk PleskWin content-length 256 date Wed, 13 Nov 2024 03:28:21 GMT content-type image/svg+xml last-modified Fri, 09 Dec 2022 13:26:50 GMT server Microsoft-IIS/10.0 x-powered-by ASP.NET
GET H2	404	icon-blugov-info.svg returncalculation.calcuttaclub.org/KINDL/KDOELD/files/	5 KB 5 KB	158ms 158ms	Image text/html	195.250.21.207 WHG-IN
General Check archive.org Show headers Download Go to Show image Full URL https://returncalculation.calcuttaclub.org/KINDL/KDOELD/files/icon-blugov-info.svg Requested by Host: returncalculation.calcuttaclub.org URL: https://returncalculation.calcuttaclub.org/KINDL/KDOELD/files/blugov.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 195.250.21.207 , United Kingdom, ASN199404 (WHG-IN, GB), Reverse DNS 604755-calcuttaclub.securehostdns.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `60c4572a3ac1c0c96caeb49c59ae79dc9d1037f0cbc9360ffbe01db1139fde3f` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://returncalculation.calcuttaclub.org/KINDL/KDOELD/files/blugov.css Response headers x-powered-by-plesk PleskWin cache-control private content-length 4975 date Wed, 13 Nov 2024 03:28:21 GMT content-type text/html; charset=utf-8 x-powered-by ASP.NET server Microsoft-IIS/10.0
GET H2	200	favicon-32x32.png returncalculation.calcuttaclub.org/KINDL/KDOELD/files/	360 B 446 B	158ms 158ms	Other image/png	195.250.21.207 WHG-IN
General Check archive.org Show headers Download Go to Full URL https://returncalculation.calcuttaclub.org/KINDL/KDOELD/files/favicon-32x32.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 195.250.21.207 , United Kingdom, ASN199404 (WHG-IN, GB), Reverse DNS 604755-calcuttaclub.securehostdns.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `72d85defa53d08b2e7976209ec80d86c3fd416b85bd1a78d79620217963acb3e` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://returncalculation.calcuttaclub.org/KINDL/KDOELD/web.php Response headers etag "0b11ca2d1bd91:0" accept-ranges bytes x-powered-by-plesk PleskWin content-length 360 date Wed, 13 Nov 2024 03:28:21 GMT content-type image/png last-modified Fri, 09 Dec 2022 13:24:58 GMT server Microsoft-IIS/10.0 x-powered-by ASP.NET

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Australian Government (Government)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			olleagi.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 049236a4345658da4fb81df5042e2296

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://returncalculation.calcuttaclub.org/KINDL/KDOELD/files/css Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://returncalculation.calcuttaclub.org/KINDL/KDOELD/files/icon-blugov-info.svg Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

olleagi.com
returncalculation.calcuttaclub.org
195.250.21.207
2a00:4b40:aaaa:2001::5
10b11a7c97b90bcf7ad520ac94c5769d08540ce1ee3b84d487c587bf128e3388
60c4572a3ac1c0c96caeb49c59ae79dc9d1037f0cbc9360ffbe01db1139fde3f
6b029a47a7bb72e8b70cf436b83d904b8a366fd360d12b4d8917c9f59e4b7d46
72d85defa53d08b2e7976209ec80d86c3fd416b85bd1a78d79620217963acb3e
954aa858b3bffb8511bc41bc88b07d2b24597c37faf522550e26c9aa3b0d220d
af454d272466fa84c77ca8028e0b8b8bcc0a193ad4401dfcddbad07dc2dabcfc
b7c93698aa2ef89c0b9109af249fcb922fca9ada8e087e4a0a7be53034d888fb
ca72017bbc6457c0fadb84afe2d0657e7a6d2455d8a1def279221c12ed892c3a

returncalculation.calcuttaclub.org Open in urlscan Pro 195.250.21.207 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

1 IPs

2 Countries

329 kBTransfer

329 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

1 Cookies

2 Console Messages

Indicators

returncalculation.calcuttaclub.org Open in urlscan Pro
195.250.21.207 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

329 kB
Transfer

329 kB
Size

1
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!