ib.boq.com.au.qobl.wf
Open in
urlscan Pro
51.83.30.6
Malicious Activity!
Public Scan
URL:
http://ib.boq.com.au.qobl.wf/
Submission: On October 31 via api from GB — Scanned from AU
Submission: On October 31 via api from GB — Scanned from AU
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 21 HTTP transactions.
The main IP is 51.83.30.6, located in
France and
belongs to OVH, FR.
The main domain is ib.boq.com.au.qobl.wf.
This is the only time ib.boq.com.au.qobl.wf was scanned on urlscan.io!
This is the only time ib.boq.com.au.qobl.wf was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Australian Government (Government)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 21 | 51.83.30.6 51.83.30.6 | 16276 (OVH) (OVH) | |
| 21 | 1 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 21 |
qobl.wf
ib.boq.com.au.qobl.wf |
1 MB |
| 21 | 1 |
| Domain | Requested by | |
|---|---|---|
| 21 | ib.boq.com.au.qobl.wf |
ib.boq.com.au.qobl.wf
|
| 21 | 1 |
| Subject Issuer | Validity | Valid |
|---|
This page contains 2 frames:
Primary Page:
http://ib.boq.com.au.qobl.wf/
Frame ID: B7D4131C072C0399A8B54D4322763EDA
Requests: 14 HTTP requests in this frame
Frame:
http://ib.boq.com.au.qobl.wf/login_files/a.html
Frame ID: 271DEB7E9BDEFDA70307C0AEAA283886
Requests: 7 HTTP requests in this frame
12 Outgoing links
These are links going to different origins than the main page.
URL: https://my.gov.au/mygov
Search URL Search Domain Scan URL
URL: https://my.gov.au/CredentialManager/recoverUserId.jsp?Origin=&Return=/sps/auth&Login=true
Title: Forgot username
Title: Forgot username
Search URL Search Domain Scan URL
URL: https://my.gov.au/CredentialManager/resetPassword.jsp?Origin=&Return=/sps/auth&Login=true
Title: Forgot password
Title: Forgot password
Search URL Search Domain Scan URL
URL: https://my.gov.au/EnrolService/register.jsp?login=true&Return=/mygov
Title: Create an account
Title: Create an account
Search URL Search Domain Scan URL
URL: https://my.gov.au/mygov/content/html/security.html
Title: protect your information
Title: protect your information
Search URL Search Domain Scan URL
URL: https://my.gov.au/mygov/content/html/about.html
Title: About myGov
Title: About myGov
Search URL Search Domain Scan URL
URL: https://my.gov.au/mygov/content/html/contact.html
Title: Contact us
Title: Contact us
Search URL Search Domain Scan URL
URL: https://my.gov.au/mygov/content/html/terms.html
Title: Terms of use
Title: Terms of use
Search URL Search Domain Scan URL
URL: https://my.gov.au/mygov/content/html/privacy.html
Title: Privacy
Title: Privacy
Search URL Search Domain Scan URL
URL: https://my.gov.au/mygov/content/html/copyright.html
Title: Copyright
Title: Copyright
Search URL Search Domain Scan URL
URL: https://my.gov.au/mygov/content/html/accessibility.html
Title: Accessibility
Title: Accessibility
Search URL Search Domain Scan URL
URL: https://my.gov.au/mygov/content/html/help.html
Title: Help
Title: Help
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
21 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
ib.boq.com.au.qobl.wf/ |
8 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
dtagent_ICA23STVbjrx_7000100291007.js
ib.boq.com.au.qobl.wf/login_files/ |
118 KB 118 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
mgv2-application.css
ib.boq.com.au.qobl.wf/login_files/ |
92 KB 92 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
austgovt-inline-white.svg
ib.boq.com.au.qobl.wf/login_files/ |
113 KB 113 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
mygov-logo.svg
ib.boq.com.au.qobl.wf/login_files/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
hand-code-device.svg
ib.boq.com.au.qobl.wf/login_files/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
austgovt-inline.svg
ib.boq.com.au.qobl.wf/login_files/ |
113 KB 113 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
mgv2-vendor.js
ib.boq.com.au.qobl.wf/login_files/ |
147 KB 147 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
mgv2-application.js
ib.boq.com.au.qobl.wf/login_files/ |
62 KB 62 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
login.js
ib.boq.com.au.qobl.wf/login_files/ |
106 B 361 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
a.html
ib.boq.com.au.qobl.wf/login_files/ Frame 271D |
5 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
va_arrowup.svg
ib.boq.com.au.qobl.wf/icons/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H/1.1 |
vagt
ib.boq.com.au.qobl.wf/mga/sps/apiauthsvc/ |
315 B 515 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
botchat.css
ib.boq.com.au.qobl.wf/login_files/a_data/ Frame 271D |
20 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
botchat-fullwindow.css
ib.boq.com.au.qobl.wf/login_files/a_data/ Frame 271D |
297 B 537 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
botchat-dhs.css
ib.boq.com.au.qobl.wf/login_files/a_data/ Frame 271D |
25 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bot.css
ib.boq.com.au.qobl.wf/login_files/a_data/ Frame 271D |
3 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
botchat.js
ib.boq.com.au.qobl.wf/login_files/a_data/ Frame 271D |
495 KB 495 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
sha256.js
ib.boq.com.au.qobl.wf/login_files/a_data/ Frame 271D |
10 KB 10 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
dynaTraceMonitor
ib.boq.com.au.qobl.wf/LoginServices/main/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H/1.1 |
dynaTraceMonitor
ib.boq.com.au.qobl.wf/LoginServices/main/ |
315 B 515 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Australian Government (Government)73 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch object| navigation object| dT_ object| dynaTrace function| $ function| moment function| cleanDefaultValues function| setMandatoryValues function| setErrorParent object| formHelper function| getGreetingTime boolean| va_isMaximised boolean| va_isOpen boolean| va_isMobile undefined| va_pushTimeout boolean| va_chatStarted string| titleBarTitle string| headingTitle function| getMobileHeader function| getDesktopHeader function| getAltText function| setAltText function| calcRightMargin function| insertDiv function| insertIframe function| determineContext function| insertIframeSrc function| setIFrameSrc function| sendGoogleAnalyltics function| addTimer function| disableBGScrolling function| enableBGScrolling function| toggleVAMobile function| addOnClickMobile function| isWindowMobile function| responsiveResize function| toggleVADesktop function| addOnClickDesktop function| addOnResize function| resizeVA function| addOnBackwardsTabbing function| loopFocusBackwardWithError function| addSkipToConversationTabListener function| addOnSkipToConversation function| addSkipToBot function| hideSkipToConversation function| skipToSkipToConversation function| skipToResizeIcon function| postMessageToIframe function| addListenerForIframe function| addDigitalAssistant function| scrollPageToBottom function| isIE undefined| lastInteractionDate undefined| timeoutEventId function| getToken function| isValidToken function| parseToken function| checkAuthenticated function| setDAsource function| recordBotInteraction function| initiateNewConversation object| storage function| isWebView object| global function| jQuery5 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| ib.boq.com.au.qobl.wf/ | Name: PHPSESSID Value: 72134094daf9e2cb061b09b3dda8606c |
|
| ib.boq.com.au.qobl.wf/ | Name: dtSa Value: - |
|
| ib.boq.com.au.qobl.wf/ | Name: dtLatC Value: 193 |
|
| ib.boq.com.au.qobl.wf/ | Name: dtCookie Value: J40FS4BRCVQTO9V56SJQH6VMSDPGLQ2B |
|
| ib.boq.com.au.qobl.wf/ | Name: dtPC Value: - |
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ib.boq.com.au.qobl.wf
51.83.30.6
0d3e9721ffc3bd9d8ca6308452cfe9d2eaf51b5f37b74093c4e05996bfa11611
13d9a59399891dc5420e0c4faa65feb6fe0a5422a9ca388d3e7706ed56f679bf
1870ce18de5358bfc0d09edfc4eae4968d43461c57a22b10a3aacc792479e33d
2864a6662507eeb582eb5b7bdfca074d30bf2ee8ebb9fada0a81082820dc69fe
351f51b382b9e3dbfd45d70ce61df4328963f32246e4523e21cfb2aba7d9bea0
36d18f0d542d9426760d3bd7ddff7e003c1c3259217a4a764312345399893bae
42ded01e719714429c120fcb2076b685587196056c7e75306c7ba0da5fd91721
4fe25ba82974e388b37b9d893dd5cbb15f3c88a1f705d337d95101e5598062bd
5a0df06a1ef208ed03a9d0609f39a3aedffcdac74499ffbf97ebc1b516d2bc85
885aaaf3099bdd3ad736a1bdd2bf230053c58114e1f9358821983d41af9b055f
8b8bd40554a405f3fe0982cd9f5d3d759810de50384c86ebf8fdd802814a4100
91e0d494b2136f506c63c13ebf1ac4a220a6e53a176ee4714505cf3703d0bdbb
a11ba53e03753ec16867238759218d80962b6b87a1b4c0dfdcb7dcc205ae610b
aee718b454049f0dea06f63b6d4c7680fbf423fe1240c45817e6543fafa3b142
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
d6e20b551788faad5ee8d08a843c1ca521b392065008f9a8051ca74152debba2
e24c13b1ad998bdf3a2b66508f87db27891825d181a06704b1fdd1a86336e680
f123bda4af8b57bf1a683920703c7841ba38aa4a98c02ef01b92d2b1d2696132