returncalculation.calcuttaclub.org Open in urlscan Pro
195.250.21.207 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://returncalculation.calcuttaclub.org/KINDL/KDOELD/sms2.php
Submission: On November 13 via automatic, source openphish (November 13th 2024, 3:09:46 pm UTC) — Scanned from GB

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 195.250.21.207, located in United Kingdom and belongs to WHG-IN, GB. The main domain is returncalculation.calcuttaclub.org.
TLS certificate: Issued by R11 on October 13th 2024. Valid for: 3 months.

This is the only time returncalculation.calcuttaclub.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Australian Government (Government)

Domain & IP information

	IP Address		AS Autonomous System
9	195.250.21.207 195.250.21.207		199404 (WHG-IN) (WHG-IN)
9	1

9 195.250.21.207 (United Kingdom)

ASN199404 (WHG-IN, GB)
PTR: 604755-calcuttaclub.securehostdns.com

returncalculation.calcuttaclub.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	calcuttaclub.org returncalculation.calcuttaclub.org	81 KB
9	1

	Domain	Requested by
9	returncalculation.calcuttaclub.org	returncalculation.calcuttaclub.org
9	1

This site contains no links.

Subject Issuer	Validity	Valid
returncalculation.calcuttaclub.org R11	`2024-10-13` - `2025-01-11`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://returncalculation.calcuttaclub.org/KINDL/KDOELD/sms2.php
Frame ID: 8C048791CA3FC4CF61ABD0147AABE447
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Transaction management - myGov

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

81 kB
Transfer

326 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request sms2.php Show response returncalculation.calcuttaclub.org/KINDL/KDOELD/	5 KB 5 KB	1000ms 187ms	Document text/html	195.250.21.207 WHG-IN
General Check archive.org Show headers Download Go to Full URL https://returncalculation.calcuttaclub.org/KINDL/KDOELD/sms2.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 195.250.21.207 , United Kingdom, ASN199404 (WHG-IN, GB), Reverse DNS 604755-calcuttaclub.securehostdns.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `6306479d3a19e5e03461252cc25d33a644e016ac69c39891a2fbec14c3fffa5a` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers content-encoding gzip content-length 5098 content-type text/html; charset=UTF-8 date Wed, 13 Nov 2024 15:09:41 GMT server Microsoft-IIS/10.0 vary Accept-Encoding x-powered-by ASP.NET x-powered-by-plesk PleskWin
GET H2	404	css returncalculation.calcuttaclub.org/KINDL/KDOELD/files/	0 0	188ms 187ms	Stylesheet text/html	195.250.21.207 WHG-IN
General Check archive.org Show headers Download Go to Full URL https://returncalculation.calcuttaclub.org/KINDL/KDOELD/files/css Requested by Host: returncalculation.calcuttaclub.org URL: https://returncalculation.calcuttaclub.org/KINDL/KDOELD/sms2.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 195.250.21.207 , United Kingdom, ASN199404 (WHG-IN, GB), Reverse DNS 604755-calcuttaclub.securehostdns.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://returncalculation.calcuttaclub.org/KINDL/KDOELD/sms2.php Response headers x-powered-by-plesk PleskWin cache-control private content-length 4621 date Wed, 13 Nov 2024 15:09:41 GMT content-type text/html; charset=utf-8 x-powered-by ASP.NET server Microsoft-IIS/10.0
GET H2	200	mgv2-application.css returncalculation.calcuttaclub.org/KINDL/KDOELD/files/	123 KB 20 KB	375ms 374ms	Stylesheet text/css	195.250.21.207 WHG-IN
General Check archive.org Show headers Download Go to Full URL https://returncalculation.calcuttaclub.org/KINDL/KDOELD/files/mgv2-application.css Requested by Host: returncalculation.calcuttaclub.org URL: https://returncalculation.calcuttaclub.org/KINDL/KDOELD/sms2.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 195.250.21.207 , United Kingdom, ASN199404 (WHG-IN, GB), Reverse DNS 604755-calcuttaclub.securehostdns.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `6b029a47a7bb72e8b70cf436b83d904b8a366fd360d12b4d8917c9f59e4b7d46` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://returncalculation.calcuttaclub.org/KINDL/KDOELD/sms2.php Response headers content-encoding gzip etag "08d9b8cb9bd91:0" accept-ranges bytes x-powered-by-plesk PleskWin content-length 20914 date Wed, 13 Nov 2024 15:09:41 GMT content-type text/css last-modified Fri, 09 Dec 2022 10:32:34 GMT vary Accept-Encoding server Microsoft-IIS/10.0 x-powered-by ASP.NET
GET H2	200	blugov.css returncalculation.calcuttaclub.org/KINDL/KDOELD/files/	69 KB 10 KB	189ms 188ms	Stylesheet text/css	195.250.21.207 WHG-IN
General Check archive.org Show headers Download Go to Full URL https://returncalculation.calcuttaclub.org/KINDL/KDOELD/files/blugov.css Requested by Host: returncalculation.calcuttaclub.org URL: https://returncalculation.calcuttaclub.org/KINDL/KDOELD/sms2.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 195.250.21.207 , United Kingdom, ASN199404 (WHG-IN, GB), Reverse DNS 604755-calcuttaclub.securehostdns.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `ca72017bbc6457c0fadb84afe2d0657e7a6d2455d8a1def279221c12ed892c3a` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://returncalculation.calcuttaclub.org/KINDL/KDOELD/sms2.php Response headers content-encoding gzip etag "078fbf1d1bd91:0" accept-ranges bytes x-powered-by-plesk PleskWin content-length 9937 date Wed, 13 Nov 2024 15:09:41 GMT content-type text/css last-modified Fri, 09 Dec 2022 13:27:12 GMT vary Accept-Encoding server Microsoft-IIS/10.0 x-powered-by ASP.NET
GET H2	200	myGov-cobranded-logo-black.svg returncalculation.calcuttaclub.org/KINDL/KDOELD/files/	63 KB 20 KB	373ms 372ms	Image image/svg+xml	195.250.21.207 WHG-IN
General Check archive.org Show headers Download Go to Show image Full URL https://returncalculation.calcuttaclub.org/KINDL/KDOELD/files/myGov-cobranded-logo-black.svg Requested by Host: returncalculation.calcuttaclub.org URL: https://returncalculation.calcuttaclub.org/KINDL/KDOELD/sms2.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 195.250.21.207 , United Kingdom, ASN199404 (WHG-IN, GB), Reverse DNS 604755-calcuttaclub.securehostdns.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `954aa858b3bffb8511bc41bc88b07d2b24597c37faf522550e26c9aa3b0d220d` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://returncalculation.calcuttaclub.org/KINDL/KDOELD/sms2.php Response headers content-encoding gzip etag "08d9b8cb9bd91:0" accept-ranges bytes x-powered-by-plesk PleskWin content-length 20721 date Wed, 13 Nov 2024 15:09:41 GMT content-type image/svg+xml last-modified Fri, 09 Dec 2022 10:32:34 GMT vary Accept-Encoding server Microsoft-IIS/10.0 x-powered-by ASP.NET
GET H2	200	otp.png returncalculation.calcuttaclub.org/KINDL/KDOELD/files/	1 KB 1 KB	374ms 373ms	Image image/png	195.250.21.207 WHG-IN
General Check archive.org Show headers Download Go to Show image Full URL https://returncalculation.calcuttaclub.org/KINDL/KDOELD/files/otp.png Requested by Host: returncalculation.calcuttaclub.org URL: https://returncalculation.calcuttaclub.org/KINDL/KDOELD/sms2.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 195.250.21.207 , United Kingdom, ASN199404 (WHG-IN, GB), Reverse DNS 604755-calcuttaclub.securehostdns.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `1edac6f4794b444d18ad68b4e32506248795177aa8d95d85d5b586672df3d097` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://returncalculation.calcuttaclub.org/KINDL/KDOELD/sms2.php Response headers etag "0f74e8d5bd91:0" accept-ranges bytes x-powered-by-plesk PleskWin content-length 1133 date Wed, 13 Nov 2024 15:09:41 GMT content-type image/png last-modified Fri, 09 Dec 2022 13:55:34 GMT server Microsoft-IIS/10.0 x-powered-by ASP.NET
GET H2	200	myGov-cobranded-logo-white.svg returncalculation.calcuttaclub.org/KINDL/KDOELD/files/	63 KB 20 KB	531ms 530ms	Image image/svg+xml	195.250.21.207 WHG-IN
General Check archive.org Show headers Download Go to Show image Full URL https://returncalculation.calcuttaclub.org/KINDL/KDOELD/files/myGov-cobranded-logo-white.svg Requested by Host: returncalculation.calcuttaclub.org URL: https://returncalculation.calcuttaclub.org/KINDL/KDOELD/sms2.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 195.250.21.207 , United Kingdom, ASN199404 (WHG-IN, GB), Reverse DNS 604755-calcuttaclub.securehostdns.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `10b11a7c97b90bcf7ad520ac94c5769d08540ce1ee3b84d487c587bf128e3388` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://returncalculation.calcuttaclub.org/KINDL/KDOELD/sms2.php Response headers content-encoding gzip etag "08d9b8cb9bd91:0" accept-ranges bytes x-powered-by-plesk PleskWin content-length 20720 date Wed, 13 Nov 2024 15:09:41 GMT content-type image/svg+xml last-modified Fri, 09 Dec 2022 10:32:34 GMT vary Accept-Encoding server Microsoft-IIS/10.0 x-powered-by ASP.NET
GET H2	404	Icons---System---Alert---Emergency.svg returncalculation.calcuttaclub.org/KINDL/KDOELD/blugov/	3 KB 3 KB	192ms 191ms	Image text/html	195.250.21.207 WHG-IN
General Check archive.org Show headers Download Go to Show image Full URL https://returncalculation.calcuttaclub.org/KINDL/KDOELD/blugov/Icons---System---Alert---Emergency.svg Requested by Host: returncalculation.calcuttaclub.org URL: https://returncalculation.calcuttaclub.org/KINDL/KDOELD/files/blugov.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 195.250.21.207 , United Kingdom, ASN199404 (WHG-IN, GB), Reverse DNS 604755-calcuttaclub.securehostdns.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `3f8d43e05207e9155e812faef1fdcc63adadbf9a2f3a0426c05ab65480015be2` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://returncalculation.calcuttaclub.org/KINDL/KDOELD/files/blugov.css Response headers x-powered-by-plesk PleskWin cache-control private content-length 5013 date Wed, 13 Nov 2024 15:09:42 GMT content-type text/html; charset=utf-8 x-powered-by ASP.NET server Microsoft-IIS/10.0
GET H2	200	favicon-32x32.png returncalculation.calcuttaclub.org/KINDL/KDOELD/files/	360 B 438 B	320ms 320ms	Other image/png	195.250.21.207 WHG-IN
General Check archive.org Show headers Download Go to Full URL https://returncalculation.calcuttaclub.org/KINDL/KDOELD/files/favicon-32x32.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 195.250.21.207 , United Kingdom, ASN199404 (WHG-IN, GB), Reverse DNS 604755-calcuttaclub.securehostdns.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `72d85defa53d08b2e7976209ec80d86c3fd416b85bd1a78d79620217963acb3e` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://returncalculation.calcuttaclub.org/KINDL/KDOELD/sms2.php Response headers etag "0b11ca2d1bd91:0" accept-ranges bytes x-powered-by-plesk PleskWin content-length 360 date Wed, 13 Nov 2024 15:09:42 GMT content-type image/png last-modified Fri, 09 Dec 2022 13:24:58 GMT server Microsoft-IIS/10.0 x-powered-by ASP.NET

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Australian Government (Government)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://returncalculation.calcuttaclub.org/KINDL/KDOELD/files/css Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://returncalculation.calcuttaclub.org/KINDL/KDOELD/blugov/Icons---System---Alert---Emergency.svg Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

returncalculation.calcuttaclub.org
195.250.21.207
10b11a7c97b90bcf7ad520ac94c5769d08540ce1ee3b84d487c587bf128e3388
1edac6f4794b444d18ad68b4e32506248795177aa8d95d85d5b586672df3d097
3f8d43e05207e9155e812faef1fdcc63adadbf9a2f3a0426c05ab65480015be2
6306479d3a19e5e03461252cc25d33a644e016ac69c39891a2fbec14c3fffa5a
6b029a47a7bb72e8b70cf436b83d904b8a366fd360d12b4d8917c9f59e4b7d46
72d85defa53d08b2e7976209ec80d86c3fd416b85bd1a78d79620217963acb3e
954aa858b3bffb8511bc41bc88b07d2b24597c37faf522550e26c9aa3b0d220d
ca72017bbc6457c0fadb84afe2d0657e7a6d2455d8a1def279221c12ed892c3a

returncalculation.calcuttaclub.org Open in urlscan Pro 195.250.21.207 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

81 kBTransfer

326 kBSize

0 Cookies

0 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

returncalculation.calcuttaclub.org Open in urlscan Pro
195.250.21.207 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

81 kB
Transfer

326 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!