nsw.gov.ph
Open in
urlscan Pro
203.177.56.222
Malicious Activity!
Public Scan
URL:
https://nsw.gov.ph/login
Submission: On March 07 via manual from PH — Scanned from DE
Submission: On March 07 via manual from PH — Scanned from DE
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 28 HTTP transactions.
The main IP is 203.177.56.222, located in
Philippines and
belongs to GLOBE-TELECOM-AS Globe Telecoms, PH.
The main domain is nsw.gov.ph.
TLS certificate: Issued by COMODO High-Assurance Secure Server CA on July 8th 2011. Valid for: 2 years.
This is the only time nsw.gov.ph was scanned on urlscan.io!
TLS certificate: Issued by COMODO High-Assurance Secure Server CA on July 8th 2011. Valid for: 2 years.
This is the only time nsw.gov.ph was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 26 | 203.177.56.222 203.177.56.222 | 4775 (GLOBE-TEL...) (GLOBE-TELECOM-AS Globe Telecoms) | |
| 2 | 2a00:1450:400... 2a00:1450:4001:830::2008 | 15169 (GOOGLE) (GOOGLE) | |
| 28 | 2 |
2
2a00:1450:4001:830::2008
(Frankfurt am Main, Germany)
ASN15169 (GOOGLE, US)
ASN15169 (GOOGLE, US)
| ssl.google-analytics.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 26 |
nsw.gov.ph
nsw.gov.ph |
262 KB |
| 2 |
google-analytics.com
ssl.google-analytics.com — Cisco Umbrella Rank: 352 |
17 KB |
| 28 | 2 |
| Domain | Requested by | |
|---|---|---|
| 26 | nsw.gov.ph |
nsw.gov.ph
|
| 2 | ssl.google-analytics.com |
nsw.gov.ph
|
| 28 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| nsw.gov.ph COMODO High-Assurance Secure Server CA |
2011-07-08 - 2013-08-07 |
2 years | crt.sh |
| *.google-analytics.com GTS CA 1C3 |
2023-02-08 - 2023-05-03 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://nsw.gov.ph/login
Frame ID: C355F64998E4097B72A9B1451B1695A7
Requests: 28 HTTP requests in this frame
Screenshot
Page Title
Phil. National Single WindowDetected technologies
Prototype
(JavaScript Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- (?:prototype|protoaculous)(?:-([\d.]*[\d]))?.*\.js
Google Analytics
(Analytics)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
script.aculo.us
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- /(?:scriptaculous|protoaculous)(?:\.js|/)
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
28 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
login
nsw.gov.ph/ |
6 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
css3-github-buttons.css
nsw.gov.ph/stylesheets/ |
13 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
screen.css
nsw.gov.ph/stylesheets/ |
5 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
styles.css
nsw.gov.ph/stylesheets/ |
15 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
common.css
nsw.gov.ph/stylesheets/ |
7 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
dynamic_form.css
nsw.gov.ph/stylesheets/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
fyi.css
nsw.gov.ph/stylesheets/ |
209 B 295 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
nsw_custom.css
nsw.gov.ph/stylesheets/ |
1 KB 715 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
prototype.js
nsw.gov.ph/javascripts/ |
127 KB 30 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
lowpro.js
nsw.gov.ph/javascripts/ |
10 KB 4 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
scriptaculous.js
nsw.gov.ph/javascripts/ |
3 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
effects.js
nsw.gov.ph/javascripts/ |
38 KB 9 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
controls.js
nsw.gov.ph/javascripts/ |
34 KB 9 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
glider.js
nsw.gov.ph/javascripts/ |
4 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-1.3.2.min.js
nsw.gov.ph/javascripts/ |
56 KB 19 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
facebox.js
nsw.gov.ph/javascripts/ |
9 KB 3 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.simpletip-1.3.1.min.js
nsw.gov.ph/javascripts/ |
5 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
application.js
nsw.gov.ph/javascripts/ |
2 KB 842 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
facebox.css
nsw.gov.ph/stylesheets/ |
1 KB 621 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
sorttable.js
nsw.gov.ph/javascripts/ |
17 KB 5 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
css3_styles.css
nsw.gov.ph/stylesheets/ |
579 B 390 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
fyi.js
nsw.gov.ph/javascripts/ |
808 B 517 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
print.css
nsw.gov.ph/stylesheets/ |
897 B 572 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
ga.js
ssl.google-analytics.com/ |
45 KB 17 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
header-anniv.png
nsw.gov.ph/images/ |
118 KB 118 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
css3-github-buttons-icons.png
nsw.gov.ph/images/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
footer-final.jpg
nsw.gov.ph/images/ |
40 KB 41 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
__utm.gif
ssl.google-analytics.com/r/ |
35 B 197 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1917665065&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~){kind=link}
%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1917665065&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~){kind=link}
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic (Online)115 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| Prototype object| Class object| Abstract object| Try function| PeriodicalExecuter function| Template object| $break object| Enumerable function| $A function| $w function| $H function| Hash function| ObjectRange function| $R object| Ajax function| $ function| Selector function| $$ object| Form object| Field function| $F object| Toggle object| Insertion object| $continue object| Position object| _prototypeEventID object| Behavior object| LowPro object| DOM function| $p function| $div function| $span function| $strong function| $em function| $img function| $table function| $tr function| $td function| $th function| $thead function| $tbody function| $tfoot function| $pre function| $code function| $h1 function| $h2 function| $h3 function| $h4 function| $h5 function| $h6 function| $ul function| $ol function| $li function| $form function| $input function| $textarea function| $legend function| $fieldset function| $select function| $option function| $blockquote function| $cite function| $br function| $hr function| $dd function| $dl function| $dt function| $address function| $a function| $button function| $abbr function| $acronym function| $script function| $link function| $style function| $bdo function| $ins function| $del function| $object function| $param function| $col function| $colgroup function| $optgroup function| $caption function| $label function| $dfn function| $kbd function| $samp function| $var function| $$$ function| Remote function| Observed object| Scriptaculous object| Effect object| Autocompleter function| Glider function| jQuery function| insert_fields function| remove_fields function| checkedAll boolean| checked boolean| stIsIE number| _timer function| dean_addEvent function| removeEvent function| handleEvent function| fixEvent function| forEach object| sorttable function| J object| _gaq object| Fyi object| _gat object| gaGlobal6 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| nsw.gov.ph/ | Name: _nclex_session Value: BAh7CDoPZXhwaXJlc19hdEl1OglUaW1lDenIHoAgAgHhBjofQG1hcnNoYWxfd2l0aF91dGNfY29lcmNpb25GOg9zZXNzaW9uX2lkIiUxOWE0MmFlZWUyNTk5M2I2MDY1ZjJjNGY4ZGU2ZjI4YToQX2NzcmZfdG9rZW4iMW0zZUdNMUUrUURDVk5POHlPUDJvaWtRb0VZcUxjVkYyenRKSUM1WVpNcHM9--8676af73ff0aa38505a6be644360bb92432734a9 |
|
| .nsw.gov.ph/ | Name: __utma Value: 13674024.1552579734.1678168577.1678168577.1678168577.1 |
|
| .nsw.gov.ph/ | Name: __utmc Value: 13674024 |
|
| .nsw.gov.ph/ | Name: __utmz Value: 13674024.1678168577.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none) |
|
| .nsw.gov.ph/ | Name: __utmt Value: 1 |
|
| .nsw.gov.ph/ | Name: __utmb Value: 13674024.1.10.1678168577 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
nsw.gov.ph
ssl.google-analytics.com
203.177.56.222
2a00:1450:4001:830::2008
018c7d12a799726510b7d6e7ce4a18023b3f70aded8102d3cdee725f34175658
01d5dbe61ef7ab1c126a732e0a3fe2afcb98a26381d4cc5008569b9ab2b79f69
0520db095b161f388a1a4811ea9576fc8093c83c34fa0974a4e10467f31a72f4
121d3199b009a078e326b9a12ded82293f2c1480b29b9bca6dcc8d072fa55c8e
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
1a126246e63170e0fdba2f31b2c3f795e32a4e2d85640ec939ee2a3d574c3b70
1c9418e68631fa52f9dc1f338a4fa7b238d99e9519ebbc82819d9eae8b257bd1
249ea254b5f40568dc750fa3004aa011f9d0771bfed0f5a8484c49fef0eb5838
2cc212a9b782b04aea4cbdf89885174c7cd5cc79fa4c23751e4c7d0719207d20
30a6e88efad6da9246b145a9853da861342d68245557ea70665eedb4aaaccb8c
3d5993faed60667e01594c00e39d1679fb5453d643151c4b3938ee842271dc04
5340ba885b9b2b9a581cac64c96195b1d637707d6e864819fb9fe0793f7616fd
63ec16fde2394a088c3b7725c2eef9c2b1e879918c90d8cab2597aa93308727a
65336603cf3a31d0b18103c69371f53a9ded1ae64253ca942d7340f4ed8609c8
6656b91743295ee1c917d66ab62c931ed73b06b2a7c0472e1e1ed997ea002685
6ae337223549c9eb54e2201ebc7c359ba08306f926aa7f61f89746e673de0422
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
88b511ad26d43e349bc6c2568d6f0ccc6cd91303ac625344d6c927328016e0f9
8f05755dd459016035bd4df73fb8f00d5f67a54c18a4a1ff9a39cede3a5b4299
9aea2a8ce6f2088f4477c54c1b64b5593eafabbf5e8b5b79c3d50dfa12f6d0e7
a699cb4e79eb9386e011ae8759f5ee087e00fa1e7c37901af3a35cdb1cda3285
a99d00fa1c5d03fb8db806968dea4c1c5d0a7dddf56a7d890c8578001b7d6510
c8370a2d050359e9d505acc411e6f457a49b21360a21e6cbc9229bad3a767899
d1e97ba3517aa1362feac8e737f246d04e745b04950ecc1d0f44601e533886e3
f00eff779991614027d350185c040dadfbac12b105ca19c40a0c0c65cb688a0d
f51e68c35b90f0c489f5186e1635ac7e9d654fc6d0c069c44124739d95353007
f77ea8b208d56454f424bee7581195fe43a5a724b8303f39cdfb06be73b873f6
fd3cbe97d91cb2bb01dfcfab17da497a7cea33ebd09dd2ef11f9be4368abf5c6