ato-gov-au.com Open in urlscan Pro
209.38.27.50 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://ato-gov-au.com/
Effective URL:
https://ato-gov-au.com/4bc56/
Submission Tags: falconsandbox
Submission: On November 11 via api (November 11th 2024, 9:16:28 pm UTC) from US — Scanned from AU

Summary HTTP 19 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 19 HTTP transactions. The main IP is 209.38.27.50, located in United States and belongs to DIGITALOCEAN-ASN, US. The main domain is ato-gov-au.com.
TLS certificate: Issued by R11 on November 11th 2024. Valid for: 3 months.

This is the only time ato-gov-au.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Australian Government (Government)

Domain & IP information

	IP Address	AS Autonomous System
2 17	209.38.27.50 209.38.27.50	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
3	172.217.174.163 172.217.174.163	15169 (GOOGLE) (GOOGLE)
1	161.146.235.204 161.146.235.204	18055 (CENTRELIN...) (CENTRELINK Department of Human Services)
19	3

17 209.38.27.50 (United States) 2 redirects

ASN14061 (DIGITALOCEAN-ASN, US)

ato-gov-au.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.217.174.163 (United States)

ASN15169 (GOOGLE, US)
PTR: kul08s11-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 161.146.235.204 (Canberra, Australia)

ASN18055 (CENTRELINK Department of Human Services, AU)

login.my.gov.au	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
17	ato-gov-au.com 2 redirects ato-gov-au.com	316 KB
3	gstatic.com fonts.gstatic.com	46 KB
1	my.gov.au login.my.gov.au — Cisco Umbrella Rank: 564702	1 KB
19	3

	Domain	Requested by
17	ato-gov-au.com	2 redirects ato-gov-au.com
3	fonts.gstatic.com	ato-gov-au.com
1	login.my.gov.au
19	3

This site contains no links.

Subject Issuer	Validity	Valid
ato-gov-au.com R11	`2024-11-11` - `2025-02-09`	3 months	crt.sh
*.gstatic.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
login.my.gov.au Entrust Certification Authority - L1M	`2024-05-14` - `2025-06-13`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://ato-gov-au.com/4bc56/
Frame ID: 1D8FFA5981409D47E056E3D2FB117F04
Requests: 19 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in with myGov - myGov

Page URL History Show full URLs

https://ato-gov-au.com/ HTTP 302
https://ato-gov-au.com/4bc56 HTTP 301
https://ato-gov-au.com/4bc56/ Page URL

Page Statistics

19
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

363 kB
Transfer

873 kB
Size

7
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://ato-gov-au.com/ HTTP 302
https://ato-gov-au.com/4bc56 HTTP 301
https://ato-gov-au.com/4bc56/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
ato-gov-au.com/4bc56/
Redirect Chain

https://ato-gov-au.com/
https://ato-gov-au.com/4bc56
https://ato-gov-au.com/4bc56/

8 KB
2 KB

9ms
9ms

Document
text/html

209.38.27.50
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://ato-gov-au.com/4bc56/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 209.38.27.50 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 31409ee7e98b91d38a6b44eae833b662b04d9326caec327c101320b0135e4000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

content-encoding: br
content-type: text/html
date: Mon, 11 Nov 2024 21:16:24 GMT
etag: W/"67327428-1ee2"
last-modified: Mon, 11 Nov 2024 21:16:24 GMT
server: nginx
x-powered-by: PleskLin

Redirect headers

content-length: 302
content-type: text/html; charset=iso-8859-1
date: Mon, 11 Nov 2024 21:16:24 GMT
location: https://ato-gov-au.com/4bc56/
server: nginx
x-powered-by: PleskLin

GET
H2 200 ruxitagentjs_ICA2NVfghjqrux_10253221019152312.js Show response
ato-gov-au.com/4bc56/index_fichiers/ 252 KB
90 KB 45ms
43ms Script
text/javascript 209.38.27.50
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://ato-gov-au.com/4bc56/index_fichiers/ruxitagentjs_ICA2NVfghjqrux_10253221019152312.js
Requested by: Host: ato-gov-au.com
URL: https://ato-gov-au.com/4bc56/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 209.38.27.50 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: da505e58bfb9de59f6c56ef0f0ceb296d42d3682ea25f8b75620621d8f4cdcb5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ato-gov-au.com/4bc56/

Response headers

content-encoding: br
date: Mon, 11 Nov 2024 21:16:24 GMT
etag: W/"67327428-3f057"
content-type: text/javascript
last-modified: Mon, 11 Nov 2024 21:16:24 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 200 css.css
ato-gov-au.com/4bc56/index_fichiers/ 17 KB
962 B 64ms
63ms Stylesheet
text/css 209.38.27.50
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://ato-gov-au.com/4bc56/index_fichiers/css.css
Requested by: Host: ato-gov-au.com
URL: https://ato-gov-au.com/4bc56/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 209.38.27.50 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: f2221a25e59d3e2ed3dc98251fac99685d0acbddf6e2e0be9b888ff61db90aaf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ato-gov-au.com/4bc56/

Response headers

content-encoding: br
date: Mon, 11 Nov 2024 21:16:24 GMT
etag: W/"67327428-42fd"
content-type: text/css
last-modified: Mon, 11 Nov 2024 21:16:24 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 200 mgv2-application.css
ato-gov-au.com/4bc56/index_fichiers/ 126 KB
20 KB 59ms
58ms Stylesheet
text/css 209.38.27.50
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://ato-gov-au.com/4bc56/index_fichiers/mgv2-application.css
Requested by: Host: ato-gov-au.com
URL: https://ato-gov-au.com/4bc56/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 209.38.27.50 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 58c6f22e85c4dce659f52d5300ad812066000f225bc34121b2737213f61e4455

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ato-gov-au.com/4bc56/

Response headers

content-encoding: br
date: Mon, 11 Nov 2024 21:16:24 GMT
etag: W/"67327428-1f8d1"
content-type: text/css
last-modified: Mon, 11 Nov 2024 21:16:24 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 200 blugov.css
ato-gov-au.com/4bc56/index_fichiers/ 70 KB
9 KB 59ms
58ms Stylesheet
text/css 209.38.27.50
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://ato-gov-au.com/4bc56/index_fichiers/blugov.css
Requested by: Host: ato-gov-au.com
URL: https://ato-gov-au.com/4bc56/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 209.38.27.50 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 62d587573e8fb758992b48ccffea6f8f1391833d14839af2681f512659ec7faa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ato-gov-au.com/4bc56/

Response headers

content-encoding: br
date: Mon, 11 Nov 2024 21:16:24 GMT
etag: W/"67327428-11844"
content-type: text/css
last-modified: Mon, 11 Nov 2024 21:16:24 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 200 myGov-cobranded-logo-black.svg
ato-gov-au.com/4bc56/index_fichiers/ 63 KB
63 KB 59ms
58ms Image
image/svg+xml 209.38.27.50
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ato-gov-au.com/4bc56/index_fichiers/myGov-cobranded-logo-black.svg
Requested by: Host: ato-gov-au.com
URL: https://ato-gov-au.com/4bc56/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 209.38.27.50 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 954aa858b3bffb8511bc41bc88b07d2b24597c37faf522550e26c9aa3b0d220d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ato-gov-au.com/4bc56/

Response headers

etag: "67327428-fa8f"
accept-ranges: bytes
content-length: 64143
date: Mon, 11 Nov 2024 21:16:24 GMT
content-type: image/svg+xml
last-modified: Mon, 11 Nov 2024 21:16:24 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 200 myGov-cobranded-logo-white.svg
ato-gov-au.com/4bc56/index_fichiers/ 63 KB
63 KB 64ms
64ms Image
image/svg+xml 209.38.27.50
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ato-gov-au.com/4bc56/index_fichiers/myGov-cobranded-logo-white.svg
Requested by: Host: ato-gov-au.com
URL: https://ato-gov-au.com/4bc56/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 209.38.27.50 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 10b11a7c97b90bcf7ad520ac94c5769d08540ce1ee3b84d487c587bf128e3388

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ato-gov-au.com/4bc56/

Response headers

etag: "67327428-fa8c"
accept-ranges: bytes
content-length: 64140
date: Mon, 11 Nov 2024 21:16:24 GMT
content-type: image/svg+xml
last-modified: Mon, 11 Nov 2024 21:16:24 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 200 mgv2-vendor.js Show response
ato-gov-au.com/4bc56/index_fichiers/ 148 KB
48 KB 43ms
43ms Script
text/javascript 209.38.27.50
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://ato-gov-au.com/4bc56/index_fichiers/mgv2-vendor.js
Requested by: Host: ato-gov-au.com
URL: https://ato-gov-au.com/4bc56/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 209.38.27.50 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 2bedda083bdbe6820e493159f1e3e27146b96ef6840094bd74447925e8c66e26

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ato-gov-au.com/4bc56/

Response headers

content-encoding: br
date: Mon, 11 Nov 2024 21:16:24 GMT
etag: W/"67327428-251cf"
content-type: text/javascript
last-modified: Mon, 11 Nov 2024 21:16:24 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 200 mgv2-application.js Show response
ato-gov-au.com/4bc56/index_fichiers/ 74 KB
16 KB 45ms
45ms Script
text/javascript 209.38.27.50
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://ato-gov-au.com/4bc56/index_fichiers/mgv2-application.js
Requested by: Host: ato-gov-au.com
URL: https://ato-gov-au.com/4bc56/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 209.38.27.50 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 107af7740499970450ef1475538b290f01f48e863cb6660e272066843582cec8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ato-gov-au.com/4bc56/

Response headers

content-encoding: br
date: Mon, 11 Nov 2024 21:16:24 GMT
etag: W/"67327428-128ea"
content-type: text/javascript
last-modified: Mon, 11 Nov 2024 21:16:24 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 200 login.js Show response
ato-gov-au.com/4bc56/index_fichiers/ 2 KB
699 B 42ms
42ms Script
text/javascript 209.38.27.50
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://ato-gov-au.com/4bc56/index_fichiers/login.js
Requested by: Host: ato-gov-au.com
URL: https://ato-gov-au.com/4bc56/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 209.38.27.50 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 3398bdeeb65157116e93bdeef72d320cb5d90700b149a62f60ff1dcb2ac8f9a5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ato-gov-au.com/4bc56/

Response headers

content-encoding: br
date: Mon, 11 Nov 2024 21:16:24 GMT
etag: W/"67327428-618"
content-type: text/javascript
last-modified: Mon, 11 Nov 2024 21:16:24 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 404 icon-blugov-info.svg
ato-gov-au.com/4bc56/icons/ 808 B
808 B 35ms
34ms Image
text/html 209.38.27.50
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ato-gov-au.com/4bc56/icons/icon-blugov-info.svg
Requested by: Host: ato-gov-au.com
URL: https://ato-gov-au.com/4bc56/index_fichiers/blugov.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 209.38.27.50 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ato-gov-au.com/4bc56/index_fichiers/blugov.css

Response headers

content-encoding: br
date: Mon, 11 Nov 2024 21:16:24 GMT
etag: W/"328-626a5ba3caec9"
content-type: text/html
last-modified: Mon, 11 Nov 2024 16:38:16 GMT
server: nginx

GET
H2 404 icon-external-link.svg
ato-gov-au.com/4bc56/icons/ 808 B
808 B 36ms
35ms Image
text/html 209.38.27.50
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ato-gov-au.com/4bc56/icons/icon-external-link.svg
Requested by: Host: ato-gov-au.com
URL: https://ato-gov-au.com/4bc56/index_fichiers/mgv2-application.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 209.38.27.50 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ato-gov-au.com/4bc56/index_fichiers/mgv2-application.css

Response headers

content-encoding: br
date: Mon, 11 Nov 2024 21:16:24 GMT
etag: W/"328-626a5ba3caec9"
content-type: text/html
last-modified: Mon, 11 Nov 2024 16:38:16 GMT
server: nginx

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
15 KB 257ms
144ms Font
font/woff2 172.217.174.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: ato-gov-au.com
URL: https://ato-gov-au.com/4bc56/index_fichiers/css.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.174.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

kul08s11-in-f3.1e100.net

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://ato-gov-au.com
Referer: https://ato-gov-au.com/

Response headers

age: 350780
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Fri, 07 Nov 2025 19:50:04 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 07 Nov 2024 19:50:04 GMT
last-modified: Wed, 11 May 2022 19:24:48 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 15744
x-xss-protection: 0
server: sffe

GET
H3 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 215ms
103ms Font
font/woff2 172.217.174.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: ato-gov-au.com
URL: https://ato-gov-au.com/4bc56/index_fichiers/css.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.174.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

kul08s11-in-f3.1e100.net

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://ato-gov-au.com
Referer: https://ato-gov-au.com/

Response headers

age: 351217
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Fri, 07 Nov 2025 19:42:47 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 07 Nov 2024 19:42:47 GMT
last-modified: Wed, 11 May 2022 19:24:42 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 15860
x-xss-protection: 0
server: sffe

GET
H3 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 16 KB
16 KB 221ms
109ms Font
font/woff2 172.217.174.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: ato-gov-au.com
URL: https://ato-gov-au.com/4bc56/index_fichiers/css.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.174.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

kul08s11-in-f3.1e100.net

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://ato-gov-au.com
Referer: https://ato-gov-au.com/

Response headers

age: 350777
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Fri, 07 Nov 2025 19:50:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 07 Nov 2024 19:50:07 GMT
last-modified: Wed, 11 May 2022 19:24:45 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 15920
x-xss-protection: 0
server: sffe

GET
H2 404 M-myGov-Coloured%20Line.svg
ato-gov-au.com/4bc56/blugov/ 808 B
808 B 10ms
10ms Image
text/html 209.38.27.50
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ato-gov-au.com/4bc56/blugov/M-myGov-Coloured%20Line.svg
Requested by: Host: ato-gov-au.com
URL: https://ato-gov-au.com/4bc56/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 209.38.27.50 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ato-gov-au.com/4bc56/

Response headers

content-encoding: br
date: Mon, 11 Nov 2024 21:16:24 GMT
etag: W/"328-626a5ba3caec9"
content-type: text/html
last-modified: Mon, 11 Nov 2024 16:38:16 GMT
server: nginx

GET
H/1.1 200
OK favicon-32x32.png
login.my.gov.au/mygov/content/mgv2/icons/ 360 B
1 KB 156ms
16ms Other
image/png 161.146.235.204
CENTRELINK Depart...

General

Check archive.org

Show headers Download Go to

Full URL

https://login.my.gov.au/mygov/content/mgv2/icons/favicon-32x32.png

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

161.146.235.204 Canberra, Australia, ASN18055 (CENTRELINK Department of Human Services, AU),

Reverse DNS

Software

Resource Hash

72d85defa53d08b2e7976209ec80d86c3fd416b85bd1a78d79620217963acb3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ato-gov-au.com/

Response headers

inst: 1a
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=3600,public,must-revalidate
x-content-type-options: nosniff
expires: Mon, 11 Nov 2024 22:16:24 GMT
accept-ranges: bytes
server-timing: dtRpid;desc="1637037145"
content-length: 360
p3p: CP="NON CUR OTPi OUR NOR UNI"
date: Mon, 11 Nov 2024 21:16:24 GMT
x-xss-protection: 1; mode=block
content-type: image/png
last-modified: Fri, 06 Sep 2024 16:05:46 GMT
vary: Accept-Encoding
x-frame-options: DENY

POST
H2 404 rb_6de8e2e9-6719-45b3-86be-7effcb9f6525 Show response
ato-gov-au.com/LoginServices/main/ 808 B
500 B 15ms
13ms XHR
text/html 209.38.27.50
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://ato-gov-au.com/LoginServices/main/rb_6de8e2e9-6719-45b3-86be-7effcb9f6525?type=js3&sn=v_4_srv_-2D23_sn_PDNN9TTD7QFDM00LJGOQ1RJN6ERND53K&svrid=-23&flavor=post&vi=PIJUMRAEPEFRMMPAJRTCCMEDMEQSUOFG-0&modifiedSince=1688839766949&rf=https%3A%2F%2Fato-gov-au.com%2F4bc56%2F&bp=3&app=5f15dc81410a75c1&crc=3008896032&en=gpalpirq&end=1
Requested by: Host: ato-gov-au.com
URL: https://ato-gov-au.com/4bc56/index_fichiers/ruxitagentjs_ICA2NVfghjqrux_10253221019152312.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 209.38.27.50 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://ato-gov-au.com/4bc56/

Response headers

content-encoding: br
date: Mon, 11 Nov 2024 21:16:25 GMT
etag: W/"328-626a5ba3caec9"
content-type: text/html
last-modified: Mon, 11 Nov 2024 16:38:16 GMT
server: nginx

POST
H2 404 rb_6de8e2e9-6719-45b3-86be-7effcb9f6525 Show response
ato-gov-au.com/LoginServices/main/ 808 B
500 B 17ms
15ms XHR
text/html 209.38.27.50
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://ato-gov-au.com/LoginServices/main/rb_6de8e2e9-6719-45b3-86be-7effcb9f6525?type=js3&sn=v_4_srv_-2D23_sn_PDNN9TTD7QFDM00LJGOQ1RJN6ERND53K&svrid=-23&flavor=post&vi=PIJUMRAEPEFRMMPAJRTCCMEDMEQSUOFG-0&modifiedSince=1688839766949&rf=https%3A%2F%2Fato-gov-au.com%2F4bc56%2F&bp=3&app=5f15dc81410a75c1&crc=4271807042&en=gpalpirq&end=1
Requested by: Host: ato-gov-au.com
URL: https://ato-gov-au.com/4bc56/index_fichiers/ruxitagentjs_ICA2NVfghjqrux_10253221019152312.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 209.38.27.50 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://ato-gov-au.com/4bc56/

Response headers

content-encoding: br
date: Mon, 11 Nov 2024 21:16:27 GMT
etag: W/"328-626a5ba3caec9"
content-type: text/html
last-modified: Mon, 11 Nov 2024 16:38:16 GMT
server: nginx

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Australian Government (Government)

81 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

7 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.ato-gov-au.com/	1969-12-31 23:59:59	Name: dtCookie Value: v_4_srv_-2D23_sn_PDNN9TTD7QFDM00LJGOQ1RJN6ERND53K
.ato-gov-au.com/	1970-01-21 10:31:59	Name: rxVisitor Value: 1731359784303H73J7CT6DPBLK0HGKGGM0343BPCFD982
.ato-gov-au.com/	1969-12-31 23:59:59	Name: dtSa Value: -
.ato-gov-au.com/	1969-12-31 23:59:59	Name: rxvt Value: 1731361584669\|1731359784304
.ato-gov-au.com/	1969-12-31 23:59:59	Name: dtPC Value: -23$359784301_945h-vPIJUMRAEPEFRMMPAJRTCCMEDMEQSUOFG-0e0
login.my.gov.au/	1970-01-21 00:56:01	Name: BIGipServerHBZK2i12N308Oa3l35yEhg Value: !r3hB/7TIHjLMXNKGbIznOHjqJgmvm7DZvs3bMm8laUIk17qTL5upSWN1ZQooJNeLohK0PUGFJoTTbw==
login.my.gov.au/	1969-12-31 23:59:59	Name: PD_STATEFUL_aaa1d6bc-31d2-11e6-b102-0050568e537f Value: %2Fmygov

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://ato-gov-au.com/4bc56/icons/icon-blugov-info.svg Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://ato-gov-au.com/4bc56/icons/icon-external-link.svg Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://ato-gov-au.com/4bc56/blugov/M-myGov-Coloured%20Line.svg Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://ato-gov-au.com/LoginServices/main/rb_6de8e2e9-6719-45b3-86be-7effcb9f6525?type=js3&sn=v_4_srv_-2D23_sn_PDNN9TTD7QFDM00LJGOQ1RJN6ERND53K&svrid=-23&flavor=post&vi=PIJUMRAEPEFRMMPAJRTCCMEDMEQSUOFG-0&modifiedSince=1688839766949&rf=https%3A%2F%2Fato-gov-au.com%2F4bc56%2F&bp=3&app=5f15dc81410a75c1&crc=3008896032&en=gpalpirq&end=1 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://ato-gov-au.com/LoginServices/main/rb_6de8e2e9-6719-45b3-86be-7effcb9f6525?type=js3&sn=v_4_srv_-2D23_sn_PDNN9TTD7QFDM00LJGOQ1RJN6ERND53K&svrid=-23&flavor=post&vi=PIJUMRAEPEFRMMPAJRTCCMEDMEQSUOFG-0&modifiedSince=1688839766949&rf=https%3A%2F%2Fato-gov-au.com%2F4bc56%2F&bp=3&app=5f15dc81410a75c1&crc=4271807042&en=gpalpirq&end=1 Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ato-gov-au.com
fonts.gstatic.com
login.my.gov.au
161.146.235.204
172.217.174.163
209.38.27.50
107af7740499970450ef1475538b290f01f48e863cb6660e272066843582cec8
10b11a7c97b90bcf7ad520ac94c5769d08540ce1ee3b84d487c587bf128e3388
2bedda083bdbe6820e493159f1e3e27146b96ef6840094bd74447925e8c66e26
31409ee7e98b91d38a6b44eae833b662b04d9326caec327c101320b0135e4000
3398bdeeb65157116e93bdeef72d320cb5d90700b149a62f60ff1dcb2ac8f9a5
58c6f22e85c4dce659f52d5300ad812066000f225bc34121b2737213f61e4455
62d587573e8fb758992b48ccffea6f8f1391833d14839af2681f512659ec7faa
72d85defa53d08b2e7976209ec80d86c3fd416b85bd1a78d79620217963acb3e
954aa858b3bffb8511bc41bc88b07d2b24597c37faf522550e26c9aa3b0d220d
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187
da505e58bfb9de59f6c56ef0f0ceb296d42d3682ea25f8b75620621d8f4cdcb5
f2221a25e59d3e2ed3dc98251fac99685d0acbddf6e2e0be9b888ff61db90aaf
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

ato-gov-au.com Open in urlscan Pro 209.38.27.50 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

19 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

363 kBTransfer

873 kBSize

7 Cookies

0 Outgoing links

Page URL History

Redirected requests

19 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

81 JavaScript Global Variables

7 Cookies

5 Console Messages

Indicators

ato-gov-au.com Open in urlscan Pro
209.38.27.50 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

19
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

363 kB
Transfer

873 kB
Size

7
Cookies

19 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!