qbvqgzn-gzt-4.ga Open in urlscan Pro
162.241.115.154  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response qbvqgzn-gzt-4.ga/gov-au/	7 KB 7 KB	652ms 134ms	Document text/html	162.241.115.154 NETWORK-SOLUTIONS...
General Check archive.org Show headers Download Go to Full URL https://qbvqgzn-gzt-4.ga/gov-au/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.241.115.154 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US), Reverse DNS 162-241-115-154.webhostbox.net Software Apache / Resource Hash 2e9769f4ad91a189777873e575f1c8bbf88f6d61c08855aa90772cc98637ef02 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Thu, 12 Jan 2023 07:44:57 GMT Keep-Alive timeout=5, max=100 Server Apache Transfer-Encoding chunked
GET H2	200	main.min.js Show response cdn.jsdelivr.net/gh/killbot-org/Killbot-JS@latest/dist/	3 KB 2 KB	68ms 24ms	Script application/javascript	2a04:4e42:400::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/gh/killbot-org/Killbot-JS@latest/dist/main.min.js Requested by Host: qbvqgzn-gzt-4.ga URL: https://qbvqgzn-gzt-4.ga/gov-au/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:400::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash a8831773f69697c641e349c519d162ad5afe58cc583703d96f98a79d29087ef1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://qbvqgzn-gzt-4.ga/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload date Thu, 12 Jan 2023 07:44:57 GMT x-content-type-options nosniff content-encoding gzip age 35424 x-jsd-version master x-cache HIT, HIT cross-origin-resource-policy cross-origin alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 1167 x-served-by cache-fra-eddf8230107-FRA, cache-hhn-etou8220037-HHN x-jsd-version-type branch etag W/"a7c-kmbumraAtj1yBda8Zbl2dRPRYqU" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=604800, s-maxage=43200 accept-ranges bytes timing-allow-origin *
GET H2	200	css fonts.googleapis.com/	16 KB 1 KB	114ms 42ms	Stylesheet text/css	2a00:1450:400d:808::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Montserrat:200,400,700|Roboto:300,400,500,700,900&display=swap Requested by Host: qbvqgzn-gzt-4.ga URL: https://qbvqgzn-gzt-4.ga/gov-au/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400d:808::200a , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 00b399de3012a5f809a1fb531286f8cdb5e7671e865f0423a0ba0dfffcc8d9c5 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://qbvqgzn-gzt-4.ga/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Thu, 12 Jan 2023 07:44:57 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Thu, 12 Jan 2023 07:44:57 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Thu, 12 Jan 2023 07:44:57 GMT
GET H/1.1	200 OK	mgv2-application.css login.my.gov.au/mygov/content/mgv2/css/	123 KB 35 KB	1476ms 300ms	Stylesheet text/css	161.146.235.204 CENTRELINK Depart...
General Check archive.org Show headers Download Go to Full URL https://login.my.gov.au/mygov/content/mgv2/css/mgv2-application.css Requested by Host: qbvqgzn-gzt-4.ga URL: https://qbvqgzn-gzt-4.ga/gov-au/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 161.146.235.204 Canberra, Australia, ASN18055 (CENTRELINK Department of Human Services, AU), Reverse DNS Software / Resource Hash 6b029a47a7bb72e8b70cf436b83d904b8a366fd360d12b4d8917c9f59e4b7d46 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://qbvqgzn-gzt-4.ga/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Thu, 12 Jan 2023 07:44:58 GMT content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains p3p CP="NON CUR OTPi OUR NOR UNI" server-timing dtRpid;desc="-325090996" content-length 34632 x-xss-protection 1; mode=block last-modified Fri, 02 Dec 2022 16:01:42 GMT vary Accept-Encoding x-frame-options DENY content-type text/css cache-control max-age=3600,public,must-revalidate accept-ranges bytes inst 1a expires Thu, 12 Jan 2023 08:44:58 GMT
GET H/1.1	200 OK	blugov.css login.my.gov.au/mygov/content/mgv2/css/	69 KB 18 KB	1475ms 299ms	Stylesheet text/css	161.146.235.204 CENTRELINK Depart...
General Check archive.org Show headers Download Go to Full URL https://login.my.gov.au/mygov/content/mgv2/css/blugov.css Requested by Host: qbvqgzn-gzt-4.ga URL: https://qbvqgzn-gzt-4.ga/gov-au/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 161.146.235.204 Canberra, Australia, ASN18055 (CENTRELINK Department of Human Services, AU), Reverse DNS Software / Resource Hash 4217794b756a7de5f436ce268788f5f5ec0d457fbba048d13aa6addf30135b14 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://qbvqgzn-gzt-4.ga/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Thu, 12 Jan 2023 07:44:58 GMT content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains p3p CP="NON CUR OTPi OUR NOR UNI" server-timing dtRpid;desc="-1929679098" content-length 17190 x-xss-protection 1; mode=block last-modified Fri, 02 Dec 2022 16:01:42 GMT vary Accept-Encoding x-frame-options DENY content-type text/css cache-control max-age=3600,public,must-revalidate accept-ranges bytes inst 1a expires Thu, 12 Jan 2023 08:44:58 GMT
GET H2	200	/ Show response api.ipify.org/	30 B 136 B	607ms 91ms	Script application/javascript	64.185.227.155 WEBNX
General Check archive.org Show headers Download Go to Full URL https://api.ipify.org/?format=jsonp&callback=getIP Requested by Host: qbvqgzn-gzt-4.ga URL: https://qbvqgzn-gzt-4.ga/gov-au/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 64.185.227.155 , United States, ASN18450 (WEBNX, US), Reverse DNS 64-185-227-155.static.webnx.com Software / Resource Hash 23a89983bc097f66bac0c23a6717fd2dcc780c79dc9fae8c078b323e7bf4cb91 Request headers accept-language de-DE,de;q=0.9 Referer https://qbvqgzn-gzt-4.ga/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers access-control-allow-origin * date Thu, 12 Jan 2023 07:44:58 GMT access-control-allow-credentials true content-length 30 vary Origin content-type application/javascript
GET H/1.1	200 OK	myGov-cobranded-logo-black.svg login.my.gov.au/mygov/content/mgv2/blugov/	63 KB 64 KB	1402ms 294ms	Image image/svg+xml	161.146.235.204 CENTRELINK Depart...
General Check archive.org Show headers Download Go to Show image Full URL https://login.my.gov.au/mygov/content/mgv2/blugov/myGov-cobranded-logo-black.svg Requested by Host: qbvqgzn-gzt-4.ga URL: https://qbvqgzn-gzt-4.ga/gov-au/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 161.146.235.204 Canberra, Australia, ASN18055 (CENTRELINK Department of Human Services, AU), Reverse DNS Software / Resource Hash 954aa858b3bffb8511bc41bc88b07d2b24597c37faf522550e26c9aa3b0d220d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://qbvqgzn-gzt-4.ga/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Thu, 12 Jan 2023 07:44:58 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff last-modified Fri, 02 Dec 2022 16:09:28 GMT vary Accept-Encoding x-frame-options DENY p3p CP="NON CUR OTPi OUR NOR UNI" content-type image/svg+xml cache-control max-age=3600,public,must-revalidate server-timing dtRpid;desc="426327898" accept-ranges bytes inst 1a content-length 64143 x-xss-protection 1; mode=block expires Thu, 12 Jan 2023 08:44:58 GMT
GET H/1.1	200 OK	myGov-cobranded-logo-white.svg login.my.gov.au/mygov/content/mgv2/blugov/	63 KB 64 KB	1401ms 293ms	Image image/svg+xml	161.146.235.204 CENTRELINK Depart...
General Check archive.org Show headers Download Go to Show image Full URL https://login.my.gov.au/mygov/content/mgv2/blugov/myGov-cobranded-logo-white.svg Requested by Host: qbvqgzn-gzt-4.ga URL: https://qbvqgzn-gzt-4.ga/gov-au/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 161.146.235.204 Canberra, Australia, ASN18055 (CENTRELINK Department of Human Services, AU), Reverse DNS Software / Resource Hash 10b11a7c97b90bcf7ad520ac94c5769d08540ce1ee3b84d487c587bf128e3388 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://qbvqgzn-gzt-4.ga/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Thu, 12 Jan 2023 07:44:58 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff last-modified Fri, 02 Dec 2022 13:08:07 GMT vary Accept-Encoding x-frame-options DENY p3p CP="NON CUR OTPi OUR NOR UNI" content-type image/svg+xml cache-control max-age=3600,public,must-revalidate server-timing dtRpid;desc="1359613961" accept-ranges bytes inst 0b content-length 64140 x-xss-protection 1; mode=block expires Thu, 12 Jan 2023 08:44:58 GMT
GET H2	200	whois Show response killbot.org/api/v2/	265 B 936 B	234ms 196ms	Fetch application/json	2606:4700:3037::ac43:a669 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://killbot.org/api/v2/whois?apikey=Gwhrue6nv7INVxMChew6XgpGD3_aLJ3imwX5OnvbETNpA Requested by Host: cdn.jsdelivr.net URL: https://cdn.jsdelivr.net/gh/killbot-org/Killbot-JS@latest/dist/main.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:a669 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c0e38268f24f67f2310f63ee4b8bb93cfbf69c1537b858dbdbe58387307c8492 Request headers accept-language de-DE,de;q=0.9 Referer https://qbvqgzn-gzt-4.ga/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Thu, 12 Jan 2023 07:44:57 GMT content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 pragma no-cache server cloudflare access-control-max-age 86400 access-control-allow-methods POST, GET content-type application/json access-control-allow-origin * report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0sWTHDNHcFG6pzlWxuvVPtHEtB6%2Fy8Krrah68DDD8sUn%2FOhiNWlsLGMWnqIVU6L4o7nBry8prej4%2B00TUagpVd1SVZoB2e26n%2F1U%2B9AqCYbl3M4TKNxsGTHeREMngMfxHMV876cBFG5SAw%3D%3D"}],"group":"cf-nel","max_age":604800} cache-control no-store, no-cache, must-revalidate access-control-allow-credentials true cf-ray 78844517c8ac2bc2-FRA bug-bounty Report to live chat :) expires Thu, 19 Nov 1981 08:52:00 GMT
GET H2	401	blocker Show response killbot.org/api/v2/	146 B 531 B	190ms 190ms	Fetch application/json	2606:4700:3037::ac43:a669 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://killbot.org/api/v2/blocker?apikey=Gwhrue6nv7INVxMChew6XgpGD3_aLJ3imwX5OnvbETNpA&ip=2a01:4a0:5a::9&ua=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/109.0.5414.74%20Safari/537.36&url= Requested by Host: cdn.jsdelivr.net URL: https://cdn.jsdelivr.net/gh/killbot-org/Killbot-JS@latest/dist/main.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:a669 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9999f5dbf899307d8d9a37abda49b26efcfc6a7dd56cb09d2c172aa4093955f1 Request headers accept-language de-DE,de;q=0.9 Referer https://qbvqgzn-gzt-4.ga/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Thu, 12 Jan 2023 07:44:57 GMT cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 pragma no-cache server cloudflare access-control-max-age 86400 access-control-allow-methods POST, GET content-type application/json access-control-allow-origin * report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=c35sbmRnlDrosXFfTnRDBvo1SRu1%2BW65YPPPOemtTPDGemrDTD3XhDv%2BR6MeJ1nVZB6TUcy6Q6zScH02Jjsb93UaVFc5u6Ws1N90ENeYe0pLifL97WVeqfympa1s%2BRnQxafNPib2XvfuLw%3D%3D"}],"group":"cf-nel","max_age":604800} cache-control no-store, no-cache, must-revalidate access-control-allow-credentials true cf-ray 788445190a622bc2-FRA bug-bounty Report to live chat :) expires Thu, 19 Nov 1981 08:52:00 GMT
GET H/1.1	200 OK	blugov-left-chevron-dark.svg login.my.gov.au/mygov/content/mgv2/icons/	256 B 1 KB	293ms 293ms	Image image/svg+xml	161.146.235.204 CENTRELINK Depart...
General Check archive.org Show headers Download Go to Show image Full URL https://login.my.gov.au/mygov/content/mgv2/icons/blugov-left-chevron-dark.svg Requested by Host: login.my.gov.au URL: https://login.my.gov.au/mygov/content/mgv2/css/blugov.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 161.146.235.204 Canberra, Australia, ASN18055 (CENTRELINK Department of Human Services, AU), Reverse DNS Software / Resource Hash af454d272466fa84c77ca8028e0b8b8bcc0a193ad4401dfcddbad07dc2dabcfc Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://login.my.gov.au/mygov/content/mgv2/css/blugov.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Thu, 12 Jan 2023 07:44:59 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff last-modified Fri, 02 Dec 2022 16:01:42 GMT vary Accept-Encoding x-frame-options DENY p3p CP="NON CUR OTPi OUR NOR UNI" content-type image/svg+xml cache-control max-age=3600,public,must-revalidate server-timing dtRpid;desc="995178288" accept-ranges bytes inst 1a content-length 256 x-xss-protection 1; mode=block expires Thu, 12 Jan 2023 08:44:59 GMT
GET H/1.1	200 OK	icon-blugov-info.svg login.my.gov.au/mygov/content/mgv2/icons/	583 B 1 KB	294ms 294ms	Image image/svg+xml	161.146.235.204 CENTRELINK Depart...
General Check archive.org Show headers Download Go to Show image Full URL https://login.my.gov.au/mygov/content/mgv2/icons/icon-blugov-info.svg Requested by Host: login.my.gov.au URL: https://login.my.gov.au/mygov/content/mgv2/css/blugov.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 161.146.235.204 Canberra, Australia, ASN18055 (CENTRELINK Department of Human Services, AU), Reverse DNS Software / Resource Hash 8c6fcb4fc5d0a351b5dcc2fa918d157ea61e6fb74a4e083509e6dcb93d4ff2f6 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://login.my.gov.au/mygov/content/mgv2/css/blugov.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Thu, 12 Jan 2023 07:44:59 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff last-modified Fri, 02 Dec 2022 16:01:42 GMT vary Accept-Encoding x-frame-options DENY p3p CP="NON CUR OTPi OUR NOR UNI" content-type image/svg+xml cache-control max-age=3600,public,must-revalidate server-timing dtRpid;desc="-269142898" accept-ranges bytes inst 1a content-length 583 x-xss-protection 1; mode=block expires Thu, 12 Jan 2023 08:44:59 GMT
GET H2	200	KFOmCnqEu92Fr1Mu4mxK.woff2 fonts.gstatic.com/s/roboto/v30/	15 KB 16 KB	32ms 7ms	Font font/woff2	2a00:1450:4001:812::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Montserrat:200,400,700|Roboto:300,400,500,700,900&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://qbvqgzn-gzt-4.ga accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Fri, 06 Jan 2023 13:14:53 GMT x-content-type-options nosniff age 498606 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15744 x-xss-protection 0 last-modified Wed, 11 May 2022 19:24:48 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sat, 06 Jan 2024 13:14:53 GMT
GET H2	200	KFOlCnqEu92Fr1MmEU9fBBc4.woff2 fonts.gstatic.com/s/roboto/v30/	16 KB 16 KB	33ms 9ms	Font font/woff2	2a00:1450:4001:812::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Montserrat:200,400,700|Roboto:300,400,500,700,900&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://qbvqgzn-gzt-4.ga accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Wed, 11 Jan 2023 20:10:25 GMT x-content-type-options nosniff age 41674 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15920 x-xss-protection 0 last-modified Wed, 11 May 2022 19:24:45 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Thu, 11 Jan 2024 20:10:25 GMT
GET H2	200	KFOlCnqEu92Fr1MmWUlfBBc4.woff2 fonts.gstatic.com/s/roboto/v30/	15 KB 16 KB	38ms 14ms	Font font/woff2	2a00:1450:4001:812::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Montserrat:200,400,700|Roboto:300,400,500,700,900&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://qbvqgzn-gzt-4.ga accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Fri, 06 Jan 2023 05:09:29 GMT x-content-type-options nosniff age 527730 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15860 x-xss-protection 0 last-modified Wed, 11 May 2022 19:24:42 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sat, 06 Jan 2024 05:09:29 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Australian Government (Government)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange object| _0x3185 function| _0x501f function| _0x34aede string| ipa function| getIP function| setIp

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			login.my.gov.au/	1969-12-31 23:59:59	Name: PD_STATEFUL_aaa1d6bc-31d2-11e6-b102-0050568e537f Value: mygov
			login.my.gov.au/	1970-01-20 08:51:51	Name: BIGipServerHBZK2i12N308Oa3l35yEhg Value: !L8bBulQWUH2hKKuU6TFomdAxad1I6g61DR0IeuL9Add6l1M2rEmhuabV8HWUKkhZoYJBZ5d4V/9xiw==

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://killbot.org/api/v2/blocker?apikey=Gwhrue6nv7INVxMChew6XgpGD3_aLJ3imwX5OnvbETNpA&ip=2a01:4a0:5a::9&ua=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/109.0.5414.74%20Safari/537.36&url= Message: Failed to load resource: the server responded with a status of 401 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.ipify.org
cdn.jsdelivr.net
fonts.googleapis.com
fonts.gstatic.com
killbot.org
login.my.gov.au
qbvqgzn-gzt-4.ga
161.146.235.204
162.241.115.154
2606:4700:3037::ac43:a669
2a00:1450:4001:812::2003
2a00:1450:400d:808::200a
2a04:4e42:400::485
64.185.227.155
00b399de3012a5f809a1fb531286f8cdb5e7671e865f0423a0ba0dfffcc8d9c5
10b11a7c97b90bcf7ad520ac94c5769d08540ce1ee3b84d487c587bf128e3388
23a89983bc097f66bac0c23a6717fd2dcc780c79dc9fae8c078b323e7bf4cb91
2e9769f4ad91a189777873e575f1c8bbf88f6d61c08855aa90772cc98637ef02
4217794b756a7de5f436ce268788f5f5ec0d457fbba048d13aa6addf30135b14
6b029a47a7bb72e8b70cf436b83d904b8a366fd360d12b4d8917c9f59e4b7d46
8c6fcb4fc5d0a351b5dcc2fa918d157ea61e6fb74a4e083509e6dcb93d4ff2f6
954aa858b3bffb8511bc41bc88b07d2b24597c37faf522550e26c9aa3b0d220d
9999f5dbf899307d8d9a37abda49b26efcfc6a7dd56cb09d2c172aa4093955f1
a8831773f69697c641e349c519d162ad5afe58cc583703d96f98a79d29087ef1
af454d272466fa84c77ca8028e0b8b8bcc0a193ad4401dfcddbad07dc2dabcfc
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
c0e38268f24f67f2310f63ee4b8bb93cfbf69c1537b858dbdbe58387307c8492
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615