returncalculation.calcuttaclub.org Open in urlscan Pro
195.250.21.207 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://returncalculation.calcuttaclub.org/KINDL/KDOELD/
Effective URL:
https://returncalculation.calcuttaclub.org/KINDL/KDOELD/web.php
Submission: On November 13 via api (November 13th 2024, 7:37:08 am UTC) from US — Scanned from GB

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 195.250.21.207, located in United Kingdom and belongs to WHG-IN, GB. The main domain is returncalculation.calcuttaclub.org.
TLS certificate: Issued by R11 on October 13th 2024. Valid for: 3 months.

This is the only time returncalculation.calcuttaclub.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Australian Government (Government)

Domain & IP information

	IP Address		AS Autonomous System
1 10	195.250.21.207 195.250.21.207		199404 (WHG-IN) (WHG-IN)
9	1

10 195.250.21.207 (United Kingdom) 1 redirects

ASN199404 (WHG-IN, GB)
PTR: 604755-calcuttaclub.securehostdns.com

returncalculation.calcuttaclub.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	calcuttaclub.org 1 redirects returncalculation.calcuttaclub.org	80 KB
9	1

	Domain	Requested by
10	returncalculation.calcuttaclub.org	1 redirects returncalculation.calcuttaclub.org
9	1

This site contains no links.

Subject Issuer	Validity	Valid
returncalculation.calcuttaclub.org R11	`2024-10-13` - `2025-01-11`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://returncalculation.calcuttaclub.org/KINDL/KDOELD/web.php
Frame ID: D1312A35DF109480E7AF95940BA2AC32
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in with myGov - myGov

Page URL History Show full URLs

https://returncalculation.calcuttaclub.org/KINDL/KDOELD/ HTTP 302
https://returncalculation.calcuttaclub.org/KINDL/KDOELD/web.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

80 kB
Transfer

325 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://returncalculation.calcuttaclub.org/KINDL/KDOELD/ HTTP 302
https://returncalculation.calcuttaclub.org/KINDL/KDOELD/web.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request web.php Show response returncalculation.calcuttaclub.org/KINDL/KDOELD/ Redirect Chain https://returncalculation.calcuttaclub.org/KINDL/KDOELD/ https://returncalculation.calcuttaclub.org/KINDL/KDOELD/web.php	6 KB 6 KB	164ms 150ms	Document text/html	195.250.21.207 WHG-IN
General Check archive.org Show headers Download Go to Full URL https://returncalculation.calcuttaclub.org/KINDL/KDOELD/web.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 195.250.21.207 , United Kingdom, ASN199404 (WHG-IN, GB), Reverse DNS 604755-calcuttaclub.securehostdns.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `b7c93698aa2ef89c0b9109af249fcb922fca9ada8e087e4a0a7be53034d888fb` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers content-encoding gzip content-length 6588 content-type text/html; charset=UTF-8 date Wed, 13 Nov 2024 07:36:57 GMT server Microsoft-IIS/10.0 vary Accept-Encoding x-powered-by ASP.NET x-powered-by-plesk PleskWin Redirect headers content-length 0 content-type text/html; charset=UTF-8 date Wed, 13 Nov 2024 07:36:57 GMT location ./web.php server Microsoft-IIS/10.0 x-powered-by ASP.NET x-powered-by-plesk PleskWin
GET H2	404	css returncalculation.calcuttaclub.org/KINDL/KDOELD/files/	0 0	355ms 278ms	Stylesheet text/html	195.250.21.207 WHG-IN
General Check archive.org Show headers Download Go to Full URL https://returncalculation.calcuttaclub.org/KINDL/KDOELD/files/css Requested by Host: returncalculation.calcuttaclub.org URL: https://returncalculation.calcuttaclub.org/KINDL/KDOELD/web.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 195.250.21.207 , United Kingdom, ASN199404 (WHG-IN, GB), Reverse DNS 604755-calcuttaclub.securehostdns.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://returncalculation.calcuttaclub.org/KINDL/KDOELD/web.php Response headers x-powered-by-plesk PleskWin cache-control private content-length 4621 date Wed, 13 Nov 2024 07:36:57 GMT content-type text/html; charset=utf-8 x-powered-by ASP.NET server Microsoft-IIS/10.0
GET H2	200	mgv2-application.css returncalculation.calcuttaclub.org/KINDL/KDOELD/files/	123 KB 21 KB	200ms 127ms	Stylesheet text/css	195.250.21.207 WHG-IN
General Check archive.org Show headers Download Go to Full URL https://returncalculation.calcuttaclub.org/KINDL/KDOELD/files/mgv2-application.css Requested by Host: returncalculation.calcuttaclub.org URL: https://returncalculation.calcuttaclub.org/KINDL/KDOELD/web.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 195.250.21.207 , United Kingdom, ASN199404 (WHG-IN, GB), Reverse DNS 604755-calcuttaclub.securehostdns.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `6b029a47a7bb72e8b70cf436b83d904b8a366fd360d12b4d8917c9f59e4b7d46` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://returncalculation.calcuttaclub.org/KINDL/KDOELD/web.php Response headers content-encoding gzip etag "08d9b8cb9bd91:0" accept-ranges bytes x-powered-by-plesk PleskWin content-length 20914 date Wed, 13 Nov 2024 07:36:57 GMT content-type text/css last-modified Fri, 09 Dec 2022 10:32:34 GMT vary Accept-Encoding server Microsoft-IIS/10.0 x-powered-by ASP.NET
GET H2	200	blugov.css returncalculation.calcuttaclub.org/KINDL/KDOELD/files/	69 KB 10 KB	350ms 277ms	Stylesheet text/css	195.250.21.207 WHG-IN
General Check archive.org Show headers Download Go to Full URL https://returncalculation.calcuttaclub.org/KINDL/KDOELD/files/blugov.css Requested by Host: returncalculation.calcuttaclub.org URL: https://returncalculation.calcuttaclub.org/KINDL/KDOELD/web.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 195.250.21.207 , United Kingdom, ASN199404 (WHG-IN, GB), Reverse DNS 604755-calcuttaclub.securehostdns.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `ca72017bbc6457c0fadb84afe2d0657e7a6d2455d8a1def279221c12ed892c3a` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://returncalculation.calcuttaclub.org/KINDL/KDOELD/web.php Response headers content-encoding gzip etag "078fbf1d1bd91:0" accept-ranges bytes x-powered-by-plesk PleskWin content-length 9937 date Wed, 13 Nov 2024 07:36:57 GMT content-type text/css last-modified Fri, 09 Dec 2022 13:27:12 GMT vary Accept-Encoding server Microsoft-IIS/10.0 x-powered-by ASP.NET
GET H2	200	myGov-cobranded-logo-black.svg returncalculation.calcuttaclub.org/KINDL/KDOELD/files/	63 KB 20 KB	350ms 277ms	Image image/svg+xml	195.250.21.207 WHG-IN
General Check archive.org Show headers Download Go to Show image Full URL https://returncalculation.calcuttaclub.org/KINDL/KDOELD/files/myGov-cobranded-logo-black.svg Requested by Host: returncalculation.calcuttaclub.org URL: https://returncalculation.calcuttaclub.org/KINDL/KDOELD/web.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 195.250.21.207 , United Kingdom, ASN199404 (WHG-IN, GB), Reverse DNS 604755-calcuttaclub.securehostdns.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `954aa858b3bffb8511bc41bc88b07d2b24597c37faf522550e26c9aa3b0d220d` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://returncalculation.calcuttaclub.org/KINDL/KDOELD/web.php Response headers content-encoding gzip etag "08d9b8cb9bd91:0" accept-ranges bytes x-powered-by-plesk PleskWin content-length 20721 date Wed, 13 Nov 2024 07:36:57 GMT content-type image/svg+xml last-modified Fri, 09 Dec 2022 10:32:34 GMT vary Accept-Encoding server Microsoft-IIS/10.0 x-powered-by ASP.NET
GET H2	200	myGov-cobranded-logo-white.svg returncalculation.calcuttaclub.org/KINDL/KDOELD/files/	63 KB 20 KB	547ms 291ms	Image image/svg+xml	195.250.21.207 WHG-IN
General Check archive.org Show headers Download Go to Show image Full URL https://returncalculation.calcuttaclub.org/KINDL/KDOELD/files/myGov-cobranded-logo-white.svg Requested by Host: returncalculation.calcuttaclub.org URL: https://returncalculation.calcuttaclub.org/KINDL/KDOELD/web.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 195.250.21.207 , United Kingdom, ASN199404 (WHG-IN, GB), Reverse DNS 604755-calcuttaclub.securehostdns.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `10b11a7c97b90bcf7ad520ac94c5769d08540ce1ee3b84d487c587bf128e3388` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://returncalculation.calcuttaclub.org/KINDL/KDOELD/web.php Response headers content-encoding gzip etag "08d9b8cb9bd91:0" accept-ranges bytes x-powered-by-plesk PleskWin content-length 20720 date Wed, 13 Nov 2024 07:36:58 GMT content-type image/svg+xml last-modified Fri, 09 Dec 2022 10:32:34 GMT vary Accept-Encoding server Microsoft-IIS/10.0 x-powered-by ASP.NET
GET H2	200	blugov-left-chevron-dark.svg returncalculation.calcuttaclub.org/KINDL/KDOELD/files/	256 B 359 B	546ms 290ms	Image image/svg+xml	195.250.21.207 WHG-IN
General Check archive.org Show headers Download Go to Show image Full URL https://returncalculation.calcuttaclub.org/KINDL/KDOELD/files/blugov-left-chevron-dark.svg Requested by Host: returncalculation.calcuttaclub.org URL: https://returncalculation.calcuttaclub.org/KINDL/KDOELD/files/blugov.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 195.250.21.207 , United Kingdom, ASN199404 (WHG-IN, GB), Reverse DNS 604755-calcuttaclub.securehostdns.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `af454d272466fa84c77ca8028e0b8b8bcc0a193ad4401dfcddbad07dc2dabcfc` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://returncalculation.calcuttaclub.org/KINDL/KDOELD/files/blugov.css Response headers etag "089dee4d1bd91:0" accept-ranges bytes x-powered-by-plesk PleskWin content-length 256 date Wed, 13 Nov 2024 07:36:58 GMT content-type image/svg+xml last-modified Fri, 09 Dec 2022 13:26:50 GMT server Microsoft-IIS/10.0 x-powered-by ASP.NET
GET H2	404	icon-blugov-info.svg returncalculation.calcuttaclub.org/KINDL/KDOELD/files/	1 KB 1 KB	547ms 291ms	Image text/html	195.250.21.207 WHG-IN
General Check archive.org Show headers Download Go to Show image Full URL https://returncalculation.calcuttaclub.org/KINDL/KDOELD/files/icon-blugov-info.svg Requested by Host: returncalculation.calcuttaclub.org URL: https://returncalculation.calcuttaclub.org/KINDL/KDOELD/files/blugov.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 195.250.21.207 , United Kingdom, ASN199404 (WHG-IN, GB), Reverse DNS 604755-calcuttaclub.securehostdns.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `3521f4ac04b99b692cc2305d52df264b1e52ca7e598546b147e967667eea4746` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://returncalculation.calcuttaclub.org/KINDL/KDOELD/files/blugov.css Response headers x-powered-by-plesk PleskWin cache-control private content-length 4975 date Wed, 13 Nov 2024 07:36:58 GMT content-type text/html; charset=utf-8 x-powered-by ASP.NET server Microsoft-IIS/10.0
GET H2	200	favicon-32x32.png returncalculation.calcuttaclub.org/KINDL/KDOELD/files/	360 B 470 B	230ms 213ms	Other image/png	195.250.21.207 WHG-IN
General Check archive.org Show headers Download Go to Full URL https://returncalculation.calcuttaclub.org/KINDL/KDOELD/files/favicon-32x32.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 195.250.21.207 , United Kingdom, ASN199404 (WHG-IN, GB), Reverse DNS 604755-calcuttaclub.securehostdns.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `72d85defa53d08b2e7976209ec80d86c3fd416b85bd1a78d79620217963acb3e` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://returncalculation.calcuttaclub.org/KINDL/KDOELD/web.php Response headers etag "0b11ca2d1bd91:0" accept-ranges bytes x-powered-by-plesk PleskWin content-length 360 date Wed, 13 Nov 2024 07:36:59 GMT content-type image/png last-modified Fri, 09 Dec 2022 13:24:58 GMT server Microsoft-IIS/10.0 x-powered-by ASP.NET

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Australian Government (Government)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://returncalculation.calcuttaclub.org/KINDL/KDOELD/files/css Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://returncalculation.calcuttaclub.org/KINDL/KDOELD/files/icon-blugov-info.svg Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

returncalculation.calcuttaclub.org
195.250.21.207
10b11a7c97b90bcf7ad520ac94c5769d08540ce1ee3b84d487c587bf128e3388
3521f4ac04b99b692cc2305d52df264b1e52ca7e598546b147e967667eea4746
6b029a47a7bb72e8b70cf436b83d904b8a366fd360d12b4d8917c9f59e4b7d46
72d85defa53d08b2e7976209ec80d86c3fd416b85bd1a78d79620217963acb3e
954aa858b3bffb8511bc41bc88b07d2b24597c37faf522550e26c9aa3b0d220d
af454d272466fa84c77ca8028e0b8b8bcc0a193ad4401dfcddbad07dc2dabcfc
b7c93698aa2ef89c0b9109af249fcb922fca9ada8e087e4a0a7be53034d888fb
ca72017bbc6457c0fadb84afe2d0657e7a6d2455d8a1def279221c12ed892c3a

returncalculation.calcuttaclub.org Open in urlscan Pro 195.250.21.207 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

80 kBTransfer

325 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

returncalculation.calcuttaclub.org Open in urlscan Pro
195.250.21.207 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

80 kB
Transfer

325 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!