au-mygov.com - urlscan.io

Summary

This website contacted 3 IPs in 2 countries across 6 domains to perform 6 HTTP transactions. The main IP is 166.62.28.107, located in Scottsdale, United States and belongs to AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US. The main domain is au-mygov.com.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on August 23rd 2019. Valid for: a year.

This is the only time au-mygov.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Australian Government (Government)

Domain & IP information

	IP Address	AS Autonomous System
1 1	35.160.193.133 35.160.193.133	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 1	52.71.51.182 52.71.51.182	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1 1	43.255.154.23 43.255.154.23	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com)
3	166.62.28.107 166.62.28.107	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com)
1	173.201.19.7 173.201.19.7	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com)
2	173.201.19.8 173.201.19.8	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com)
6	3

1 35.160.193.133 (Boardman, United States) 1 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-35-160-193-133.us-west-2.compute.amazonaws.com

links.ascendbywix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.71.51.182 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-71-51-182.compute-1.amazonaws.com

shoutout.wix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 43.255.154.23 (Singapore, Singapore) 1 redirects

ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-43-255-154-23.ip.secureserver.net

tax-mygov.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 166.62.28.107 (Scottsdale, United States)

ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-166-62-28-107.ip.secureserver.net

au-mygov.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 173.201.19.7 (Scottsdale, United States)

ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: seal.starfieldtech.com

seal.starfieldtech.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 173.201.19.8 (Scottsdale, United States)

ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: seal.godaddy.com

seal.godaddy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	au-mygov.com au-mygov.com	38 KB
2	godaddy.com seal.godaddy.com	6 KB
1	starfieldtech.com seal.starfieldtech.com	301 B
1	tax-mygov.com 1 redirects tax-mygov.com	326 B
1	wix.com 1 redirects shoutout.wix.com	290 B
1	ascendbywix.com 1 redirects links.ascendbywix.com	339 B
6	6

	Domain	Requested by
3	au-mygov.com	au-mygov.com
2	seal.godaddy.com	au-mygov.com
1	seal.starfieldtech.com	au-mygov.com
1	tax-mygov.com	1 redirects
1	shoutout.wix.com	1 redirects
1	links.ascendbywix.com	1 redirects
6	6

This site contains no links.

Subject Issuer	Validity	Valid
au-mygov.com Go Daddy Secure Certificate Authority - G2	`2019-08-23` - `2020-08-23`	a year	crt.sh
seal.starfieldtech.com Starfield Secure Certificate Authority - G2	`2018-10-23` - `2020-10-23`	2 years	crt.sh
seal.godaddy.com Go Daddy Secure Certificate Authority - G2	`2018-09-12` - `2020-09-12`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://au-mygov.com/8384719/verification/login.php
Frame ID: F07F80615A9FDE7F781161CED329339F
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://links.ascendbywix.com/f/a/v2r87Q98UqAb-UZhJ0xIvQ~~/AABFVwA~/RgRfRqLiP0SRaHR0cHM6Ly9zaG91dG91dC53aX... HTTP 302
https://shoutout.wix.com/so/bcMpE-iHj/click?w=LS0tDQo4NzE0NDQzMS1hMTUzLTRkY2ItOTUxNy1jMmM3ZWZiNTRiYTM... HTTP 302
http://tax-mygov.com/d.php HTTP 302
https://au-mygov.com/8384719/verification/login.php Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

6
Domains

6
Subdomains

3
IPs

2
Countries

44 kB
Transfer

48 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://links.ascendbywix.com/f/a/v2r87Q98UqAb-UZhJ0xIvQ~~/AABFVwA~/RgRfRqLiP0SRaHR0cHM6Ly9zaG91dG91dC53aXguY29tL3NvL2JjTXBFLWlIai9jbGljaz93PUxTMHREUW80TnpFME5EUXpNUzFoTVRVekxUUmtZMkl0T1RVeE55MWpNbU0zWldaaU5UUmlZVE1OQ21oMGRIQTZMeTkwWVhndGJYbG5iM1l1WTI5dEwyUXVjR2h3RFFvdExTMFcDc3BjQgoAHuIdZF2NMJYoUhZjaGV2cm9ja2V0QGhvdG1haWwuY29tWAQAAoPw HTTP 302
https://shoutout.wix.com/so/bcMpE-iHj/click?w=LS0tDQo4NzE0NDQzMS1hMTUzLTRkY2ItOTUxNy1jMmM3ZWZiNTRiYTMNCmh0dHA6Ly90YXgtbXlnb3YuY29tL2QucGhwDQotLS0 HTTP 302
http://tax-mygov.com/d.php HTTP 302
https://au-mygov.com/8384719/verification/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request login.php Show response
au-mygov.com/8384719/verification/
Redirect Chain

http://links.ascendbywix.com/f/a/v2r87Q98UqAb-UZhJ0xIvQ~~/AABFVwA~/RgRfRqLiP0SRaHR0cHM6Ly9zaG91dG91dC53aXguY29tL3NvL2JjTXBFLWlIai9jbGljaz93PUxTMHREUW80TnpFME5EUXpNUzFoTVRVekxUUmtZMkl0T1RVeE55MWpNbU...
https://shoutout.wix.com/so/bcMpE-iHj/click?w=LS0tDQo4NzE0NDQzMS1hMTUzLTRkY2ItOTUxNy1jMmM3ZWZiNTRiYTMNCmh0dHA6Ly90YXgtbXlnb3YuY29tL2QucGhwDQotLS0
http://tax-mygov.com/d.php
https://au-mygov.com/8384719/verification/login.php

4 KB
2 KB

7824ms
382ms

Document
text/html

166.62.28.107
GoDaddy.com

General

Check archive.org

Show headers Download Go to

Full URL: https://au-mygov.com/8384719/verification/login.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 166.62.28.107 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS: ip-166-62-28-107.ip.secureserver.net
Software: Apache / PHP/7.2.19
Resource Hash: 768d21a5b187d68d7a933c2fb74327463a41c21d89a466978cf55f56a38d5645

Request headers

:method: GET
:authority: au-mygov.com
:scheme: https
:path: /8384719/verification/login.php
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: none
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Tue, 27 Aug 2019 02:34:35 GMT
server: Apache
x-powered-by: PHP/7.2.19
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
set-cookie: PHPSESSID=17a4628fab85c930c1821b0136535e20; path=/
vary: Accept-Encoding,User-Agent
content-encoding: gzip
content-length: 1557
content-type: text/html; charset=UTF-8

Redirect headers

Date: Tue, 27 Aug 2019 02:34:27 GMT
Server: Apache
X-Powered-By: PHP/7.2.19
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Location: https://au-mygov.com/8384719/verification/login.php
Vary: User-Agent
Content-Length: 0
Keep-Alive: timeout=5
Content-Type: text/html; charset=UTF-8

GET
H2 200 mygo.PNG
au-mygov.com/8384719/verification/ 9 KB
10 KB 186ms
185ms Image
image/png 166.62.28.107
GoDaddy.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://au-mygov.com/8384719/verification/mygo.PNG
Requested by: Host: au-mygov.com
URL: https://au-mygov.com/8384719/verification/login.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 166.62.28.107 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS: ip-166-62-28-107.ip.secureserver.net
Software: Apache /
Resource Hash: 2dfe4e606852a953989cc4ed462a83f26d234cecb77c424f24ff3afb73b2c85f

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://au-mygov.com/8384719/verification/login.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 27 Aug 2019 02:34:35 GMT
last-modified: Sun, 10 Mar 2019 16:28:58 GMT
server: Apache
etag: "22e00db-2598-583bff3ede680"
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 9624

GET
H/1.1 204
No Content getSeal Show response
seal.starfieldtech.com/ 0
301 B 4051ms
186ms Script
text/plain 173.201.19.7
GoDaddy.com

General

Check archive.org

Show headers Download Go to

Full URL

https://seal.starfieldtech.com/getSeal?sealID=8d1mfK5yKq7g4ipqAxUL3KEQORIguOJgcLVM0aKhFWi38X50VJVvMiFlyuJg

Requested by

Host: au-mygov.com
URL: https://au-mygov.com/8384719/verification/login.php

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

173.201.19.7 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),

Reverse DNS

seal.starfieldtech.com

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://au-mygov.com/8384719/verification/login.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 27 Aug 2019 02:34:39 GMT
Server: Apache
Connection: Keep-Alive
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
Keep-Alive: timeout=2, max=100
X-Frame-Options: SAMEORIGIN
Content-Type: text/plain; charset=UTF-8

GET
H/1.1 200
OK getSeal Show response
seal.godaddy.com/ 4 KB
2 KB 8922ms
189ms Script
text/html 173.201.19.8
GoDaddy.com

General

Check archive.org

Show headers Download Go to

Full URL

https://seal.godaddy.com/getSeal?sealID=yhWwPPUuWEFc1hyGTqGLwnjANxjhhjoqpxcH4CT68u2sXDnVUnTwnMf0Kk95

Requested by

Host: au-mygov.com
URL: https://au-mygov.com/8384719/verification/login.php

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

173.201.19.8 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),

Reverse DNS

seal.godaddy.com

Software

Apache /

Resource Hash

2c0248858aaf8e2aa74d0bdf2dd7f70d8cf9954b5e32aacaf1ae2aef312c4e95

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://au-mygov.com/8384719/verification/login.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 27 Aug 2019 02:34:44 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Server: Apache
X-Frame-Options: SAMEORIGIN
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
Cache-Control: max-age=14400
Transfer-Encoding: chunked
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Keep-Alive: timeout=2, max=100
Expires: Tue, 27 Aug 2019 06:34:44 GMT

GET
H2 200 ask.PNG
au-mygov.com/8384719/verification/ 26 KB
26 KB 185ms
185ms Image
image/png 166.62.28.107
GoDaddy.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://au-mygov.com/8384719/verification/ask.PNG
Requested by: Host: au-mygov.com
URL: https://au-mygov.com/8384719/verification/login.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 166.62.28.107 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS: ip-166-62-28-107.ip.secureserver.net
Software: Apache /
Resource Hash: 429cb9971c2e3770034b4d742611060a4cf085c8cc9cda0b06031651d85a55dd

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://au-mygov.com/8384719/verification/login.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 27 Aug 2019 02:34:35 GMT
last-modified: Sat, 09 Mar 2019 12:17:56 GMT
server: Apache
etag: "22e00de-67e4-583a85452a500"
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 26596

GET
H/1.1 200
OK siteseal_gd_3_h_l_m.gif
seal.godaddy.com/images/3/en/ 4 KB
4 KB 171ms
171ms Image
image/gif 173.201.19.8
GoDaddy.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://seal.godaddy.com/images/3/en/siteseal_gd_3_h_l_m.gif

Requested by

Host: au-mygov.com
URL: https://au-mygov.com/8384719/verification/login.php

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

173.201.19.8 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),

Reverse DNS

seal.godaddy.com

Software

Apache /

Resource Hash

1449346947ba3d2266f702cc5488e1a0fb75ef67cdb105d5dbe178eff0af14b2

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://au-mygov.com/8384719/verification/login.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 27 Aug 2019 02:34:44 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
Cache-Control: max-age=86400
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Type: image/gif
Keep-Alive: timeout=2, max=99
Content-Length: 3827
Expires: Wed, 28 Aug 2019 02:34:44 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Australian Government (Government)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| seal_getFlashVersion function| seal_useFlash function| seal_installSeal function| verifySeal

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

au-mygov.com
links.ascendbywix.com
seal.godaddy.com
seal.starfieldtech.com
shoutout.wix.com
tax-mygov.com
166.62.28.107
173.201.19.7
173.201.19.8
35.160.193.133
43.255.154.23
52.71.51.182
1449346947ba3d2266f702cc5488e1a0fb75ef67cdb105d5dbe178eff0af14b2
2c0248858aaf8e2aa74d0bdf2dd7f70d8cf9954b5e32aacaf1ae2aef312c4e95
2dfe4e606852a953989cc4ed462a83f26d234cecb77c424f24ff3afb73b2c85f
429cb9971c2e3770034b4d742611060a4cf085c8cc9cda0b06031651d85a55dd
768d21a5b187d68d7a933c2fb74327463a41c21d89a466978cf55f56a38d5645
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

au-mygov.com Open in urlscan Pro 166.62.28.107 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

0 %IPv6

6 Domains

6 Subdomains

3 IPs

2 Countries

44 kBTransfer

48 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

Indicators

au-mygov.com Open in urlscan Pro
166.62.28.107 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

0 %
IPv6

6
Domains

6
Subdomains

3
IPs

2
Countries

44 kB
Transfer

48 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!