my.income-security-portal.net Open in urlscan Pro
84.32.188.209 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://my.income-security-portal.net/mym
Submission: On December 28 via manual (December 28th 2022, 6:26:05 am UTC) from AU — Scanned from AU

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 10 HTTP transactions. The main IP is 84.32.188.209, located in Lithuania and belongs to CHERRYSERVERS2-AS, LT. The main domain is my.income-security-portal.net.
TLS certificate: Issued by R3 on December 28th 2022. Valid for: 3 months.

This is the only time my.income-security-portal.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Australian Government (Government)

Domain & IP information

	IP Address	AS Autonomous System
9	84.32.188.209 84.32.188.209	59642 (CHERRYSER...) (CHERRYSERVERS2-AS)
1	69.16.175.10 69.16.175.10	20446 (STACKPATH...) (STACKPATH-CDN)
10	2

9 84.32.188.209 (Lithuania)

ASN59642 (CHERRYSERVERS2-AS, LT)

my.income-security-portal.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.16.175.10 (United States)

ASN20446 (STACKPATH-CDN, US)
PTR: tlb.hwcdn.net

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	income-security-portal.net my.income-security-portal.net	319 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 866	31 KB
10	2

	Domain	Requested by
9	my.income-security-portal.net	my.income-security-portal.net code.jquery.com
1	code.jquery.com	my.income-security-portal.net
10	2

This site contains no links.

Subject Issuer	Validity	Valid
my.income-security-portal.net R3	`2022-12-28` - `2023-03-28`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2022-08-03` - `2023-07-14`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://my.income-security-portal.net/mym
Frame ID: 17A2FD9674B40A4C1D836E50C05D20DE
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign-in - myGov

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

350 kB
Transfer

404 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request mym Show response my.income-security-portal.net/	8 KB 8 KB	2873ms 1633ms	Document text/html	84.32.188.209 CHERRYSERVERS2-AS
General Check archive.org Show headers Download Go to Full URL https://my.income-security-portal.net/mym Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 84.32.188.209 , Lithuania, ASN59642 (CHERRYSERVERS2-AS, LT), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 / PHP/7.4.33 Resource Hash `ee15a79684f7e856c034434a4ead0e17a966893a3bba171dc1edee2fcb0f28f6` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 accept-language en-AU,en;q=0.9 Response headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Length 7902 Content-Type text/html; charset=UTF-8 Date Wed, 28 Dec 2022 06:25:57 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=100 Pragma no-cache Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 X-Powered-By PHP/7.4.33
GET H/1.1	200 OK	mgv2-application.css my.income-security-portal.net/assets/mym/	121 KB 122 KB	390ms 390ms	Stylesheet text/css	84.32.188.209 CHERRYSERVERS2-AS
General Check archive.org Show headers Download Go to Full URL https://my.income-security-portal.net/assets/mym/mgv2-application.css?v1 Requested by Host: my.income-security-portal.net URL: https://my.income-security-portal.net/mym Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 84.32.188.209 , Lithuania, ASN59642 (CHERRYSERVERS2-AS, LT), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 / Resource Hash `b1ec73d98e7959f00b50b54802df6b7d5ec2b2890221d5ad0e9df88c27513891` Request headers accept-language en-AU,en;q=0.9 Referer https://my.income-security-portal.net/mym User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Date Wed, 28 Dec 2022 06:25:59 GMT Last-Modified Wed, 16 Mar 2022 11:14:48 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 ETag "1e4f0-5da540580fa00" Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 124144
GET H/1.1	200 OK	austgovt-inline-white.svg my.income-security-portal.net/assets/mym/	113 KB 113 KB	389ms 389ms	Image image/svg+xml	84.32.188.209 CHERRYSERVERS2-AS
General Check archive.org Show headers Download Go to Show image Full URL https://my.income-security-portal.net/assets/mym/austgovt-inline-white.svg Requested by Host: my.income-security-portal.net URL: https://my.income-security-portal.net/mym Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 84.32.188.209 , Lithuania, ASN59642 (CHERRYSERVERS2-AS, LT), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 / Resource Hash `42ded01e719714429c120fcb2076b685587196056c7e75306c7ba0da5fd91721` Request headers accept-language en-AU,en;q=0.9 Referer https://my.income-security-portal.net/mym User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Date Wed, 28 Dec 2022 06:25:59 GMT Last-Modified Sun, 13 Mar 2022 18:01:28 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 ETag "1c460-5da1d5a554e00" Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 115808
GET H/1.1	200 OK	mygov-logo.svg my.income-security-portal.net/assets/mym/	2 KB 2 KB	1167ms 390ms	Image image/svg+xml	84.32.188.209 CHERRYSERVERS2-AS
General Check archive.org Show headers Download Go to Show image Full URL https://my.income-security-portal.net/assets/mym/mygov-logo.svg Requested by Host: my.income-security-portal.net URL: https://my.income-security-portal.net/mym Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 84.32.188.209 , Lithuania, ASN59642 (CHERRYSERVERS2-AS, LT), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 / Resource Hash `91e0d494b2136f506c63c13ebf1ac4a220a6e53a176ee4714505cf3703d0bdbb` Request headers accept-language en-AU,en;q=0.9 Referer https://my.income-security-portal.net/mym User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Date Wed, 28 Dec 2022 06:26:00 GMT Last-Modified Sun, 13 Mar 2022 18:01:36 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 ETag "8a1-5da1d5acf6000" Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 2209
GET H/1.1	200 OK	icon-external-link-blue.svg my.income-security-portal.net/assets/mym/	742 B 1 KB	1168ms 390ms	Image image/svg+xml	84.32.188.209 CHERRYSERVERS2-AS
General Check archive.org Show headers Download Go to Show image Full URL https://my.income-security-portal.net/assets/mym/icon-external-link-blue.svg Requested by Host: my.income-security-portal.net URL: https://my.income-security-portal.net/mym Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 84.32.188.209 , Lithuania, ASN59642 (CHERRYSERVERS2-AS, LT), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 / Resource Hash `e470bb1617b294c5f4c8c456278f819d1640b90c2c15e5d237d3c0683aa32a22` Request headers accept-language en-AU,en;q=0.9 Referer https://my.income-security-portal.net/mym User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Date Wed, 28 Dec 2022 06:26:00 GMT Last-Modified Sun, 13 Mar 2022 18:01:46 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 ETag "2e6-5da1d5b67f680" Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 742
GET H/1.1	200 OK	austgovt-inline.svg my.income-security-portal.net/assets/mym/	71 KB 71 KB	569ms 389ms	Image image/svg+xml	84.32.188.209 CHERRYSERVERS2-AS
General Check archive.org Show headers Download Go to Show image Full URL https://my.income-security-portal.net/assets/mym/austgovt-inline.svg Requested by Host: my.income-security-portal.net URL: https://my.income-security-portal.net/mym Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 84.32.188.209 , Lithuania, ASN59642 (CHERRYSERVERS2-AS, LT), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 / Resource Hash `bfbb8c3288312fe27cba0cdd45fe392f7f8af33c3d61c78b133744c7b494c8e8` Request headers accept-language en-AU,en;q=0.9 Referer https://my.income-security-portal.net/mym User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Date Wed, 28 Dec 2022 06:26:00 GMT Last-Modified Sun, 13 Mar 2022 18:01:54 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 ETag "11a6c-5da1d5be20880" Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 72300
GET H2	200	jquery-3.6.0.min.js Show response code.jquery.com/	87 KB 31 KB	733ms 241ms	Script application/javascript	69.16.175.10 STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.6.0.min.js Requested by Host: my.income-security-portal.net URL: https://my.income-security-portal.net/mym Protocol H2 Security TLS 1.3, , AES_128_GCM Server 69.16.175.10 , United States, ASN20446 (STACKPATH-CDN, US), Reverse DNS tlb.hwcdn.net Software nginx / Resource Hash `ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e` Request headers Referer https://my.income-security-portal.net/ Origin https://my.income-security-portal.net accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Wed, 28 Dec 2022 06:25:59 GMT content-encoding gzip x-sp-metadata HS256.CIffr50GEokBCiRlNTU1MmUzNi0wMjRmLTQzZDQtODc2NS0xODkwODAzMGYzZTkQ+OiCoKvU+wIaBgj3wq+dBiIOMTczLjI0NS4yMDkuNTIotqECMAM4BEIWVExTX0FFU18xMjhfR0NNX1NIQTI1NlogM2U5YjIwNjEwMDk4YjZjOWJmZjk1Mzg1NmU1ODAxNmEaLAgBEiQ4YmIwNzMxZS0zNjA4LTRhZGMtOTYyNi0zNTZlNzI2N2NmMDkYm/EBIhgIAhIUY2RzMjY3LmxhMy5od2Nkbi5uZXQ=.A+QYACsWTtTsWoZlnM2stSALzDUwqkuGrRA3WsmTM2o= last-modified Wed, 16 Feb 2022 10:50:39 GMT server nginx etag W/"620cd6ff-15d9d" vary Accept-Encoding x-hw 1672208759.dop006.la3.t,1672208759.cds222.la3.hn,1672208759.cds267.la3.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30875
GET H/1.1	200 OK	actions.js Show response my.income-security-portal.net/assets/js/	778 B 1 KB	1167ms 390ms	Script application/javascript	84.32.188.209 CHERRYSERVERS2-AS
General Check archive.org Show headers Download Go to Full URL https://my.income-security-portal.net/assets/js/actions.js?v=1672208759 Requested by Host: my.income-security-portal.net URL: https://my.income-security-portal.net/mym Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 84.32.188.209 , Lithuania, ASN59642 (CHERRYSERVERS2-AS, LT), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 / Resource Hash `411a7dde58e7f50627e413a47dda8ef4d5d11ec89ac4b78b8416a66badf7bd60` Request headers accept-language en-AU,en;q=0.9 Referer https://my.income-security-portal.net/mym User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Date Wed, 28 Dec 2022 06:26:00 GMT Last-Modified Wed, 27 Apr 2022 15:39:38 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 ETag "30a-5dda49df4e280" Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 778
GET H/1.1	404 Not Found	link-arrow.svg my.income-security-portal.net/assets/icons/	31 B 31 B	390ms 390ms	Image text/html	84.32.188.209 CHERRYSERVERS2-AS
General Check archive.org Show headers Download Go to Show image Full URL https://my.income-security-portal.net/assets/icons/link-arrow.svg Requested by Host: my.income-security-portal.net URL: https://my.income-security-portal.net/assets/mym/mgv2-application.css?v1 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 84.32.188.209 , Lithuania, ASN59642 (CHERRYSERVERS2-AS, LT), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 / PHP/7.4.33 Resource Hash `f7712d669184cbf9da44b15ceacfdc3c4bbcfc683d0b7a248d823636f57748e8` Request headers accept-language en-AU,en;q=0.9 Referer https://my.income-security-portal.net/assets/mym/mgv2-application.css?v1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Date Wed, 28 Dec 2022 06:26:01 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 Connection Keep-Alive X-Powered-By PHP/7.4.33 Content-Length 31 Keep-Alive timeout=5, max=98 Content-Type text/html; charset=UTF-8
POST H/1.1	200 OK	action Show response my.income-security-portal.net/apis/lr/	25 B 394 B	540ms 540ms	XHR text/html	84.32.188.209 CHERRYSERVERS2-AS
General Check archive.org Show headers Download Go to Full URL https://my.income-security-portal.net/apis/lr/action Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.6.0.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 84.32.188.209 , Lithuania, ASN59642 (CHERRYSERVERS2-AS, LT), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 / PHP/7.4.33 Resource Hash `c1cbbd152a050ee0dc982af665d16b3508db3942527b4b1d65aff0127244ac9e` Request headers Accept / Referer https://my.income-security-portal.net/mym X-Requested-With XMLHttpRequest accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers Pragma no-cache Date Wed, 28 Dec 2022 06:26:02 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 X-Powered-By PHP/7.4.33 Content-Type text/html; charset=UTF-8 Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Keep-Alive timeout=5, max=98 Content-Length 25 Expires Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Australian Government (Government)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			my.income-security-portal.net/	1969-12-31 23:59:59	Name: PHPSESSID Value: gntecm0ct5rhvnr1jvu7p9rqf9

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://my.income-security-portal.net/assets/icons/link-arrow.svg Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
my.income-security-portal.net
69.16.175.10
84.32.188.209
411a7dde58e7f50627e413a47dda8ef4d5d11ec89ac4b78b8416a66badf7bd60
42ded01e719714429c120fcb2076b685587196056c7e75306c7ba0da5fd91721
91e0d494b2136f506c63c13ebf1ac4a220a6e53a176ee4714505cf3703d0bdbb
b1ec73d98e7959f00b50b54802df6b7d5ec2b2890221d5ad0e9df88c27513891
bfbb8c3288312fe27cba0cdd45fe392f7f8af33c3d61c78b133744c7b494c8e8
c1cbbd152a050ee0dc982af665d16b3508db3942527b4b1d65aff0127244ac9e
e470bb1617b294c5f4c8c456278f819d1640b90c2c15e5d237d3c0683aa32a22
ee15a79684f7e856c034434a4ead0e17a966893a3bba171dc1edee2fcb0f28f6
f7712d669184cbf9da44b15ceacfdc3c4bbcfc683d0b7a248d823636f57748e8
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

my.income-security-portal.net Open in urlscan Pro 84.32.188.209 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

10 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

350 kBTransfer

404 kBSize

1 Cookies

0 Outgoing links

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

my.income-security-portal.net Open in urlscan Pro
84.32.188.209 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

350 kB
Transfer

404 kB
Size

1
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!