correu.thewealthyplace.org Open in urlscan Pro
204.11.58.229  Malicious Activity! Public Scan

URL: http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/index2.html
Submission: On February 10 via manual from IN — Scanned from DE

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 12 HTTP transactions. The main IP is 204.11.58.229, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is correu.thewealthyplace.org.
This is the only time correu.thewealthyplace.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Australian Government (Government)

Domain & IP information

IP Address AS Autonomous System
12 204.11.58.229 46606 (UNIFIEDLA...)
12 1
Apex Domain
Subdomains
Transfer
12 thewealthyplace.org
correu.thewealthyplace.org
176 KB
12 1
Domain Requested by
12 correu.thewealthyplace.org correu.thewealthyplace.org
12 1

This site contains links to these domains. Also see Links.

Domain
beta.my.gov.au
login.my.gov.au
my.gov.au
Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/index2.html
Frame ID: 214D6624F379EB9ECB8ECAC2E9530759
Requests: 12 HTTP requests in this frame

Screenshot

Page Title

Sign in with myGov - myGov

Page Statistics

12
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

176 kB
Transfer

324 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request index2.html
correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/
7 KB
3 KB
Document
General
Full URL
http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/index2.html
Protocol
HTTP/1.1
Server
204.11.58.229 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
bh-45.webhostbox.net
Software
Apache /
Resource Hash
70c5200075943a579063b1a9941850b2cc4ab1b1c77235452b5603b1299d0e15

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Connection
Upgrade, Keep-Alive
Content-Encoding
gzip
Content-Length
2943
Content-Type
text/html
Date
Fri, 10 Feb 2023 05:09:07 GMT
Keep-Alive
timeout=5, max=75
Last-Modified
Tue, 17 Jan 2023 23:35:30 GMT
Server
Apache
Upgrade
h2,h2c
Vary
Accept-Encoding
ruxitagentjs_ICA2Vfghjqrux_10247220811100421.js
correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/css/
0
0
Script
General
Full URL
http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/css/ruxitagentjs_ICA2Vfghjqrux_10247220811100421.js
Requested by
Host: correu.thewealthyplace.org
URL: http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/index2.html
Protocol
HTTP/1.1
Server
204.11.58.229 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
bh-45.webhostbox.net
Software
Apache /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/index2.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date
Fri, 10 Feb 2023 05:09:07 GMT
Server
Apache
Connection
close
Content-Length
0
Content-Type
text/html; charset=UTF-8
css.css
correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/css/
0
0
Stylesheet
General
Full URL
http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/css/css.css
Requested by
Host: correu.thewealthyplace.org
URL: http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/index2.html
Protocol
HTTP/1.1
Server
204.11.58.229 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
bh-45.webhostbox.net
Software
Apache /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/index2.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Upgrade
h2,h2c
Date
Fri, 10 Feb 2023 05:09:07 GMT
Server
Apache
Connection
Upgrade, close
Content-Length
0
Content-Type
text/html; charset=UTF-8
mgv2-application.css
correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/css/
123 KB
32 KB
Stylesheet
General
Full URL
http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/css/mgv2-application.css
Requested by
Host: correu.thewealthyplace.org
URL: http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/index2.html
Protocol
HTTP/1.1
Server
204.11.58.229 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
bh-45.webhostbox.net
Software
Apache /
Resource Hash
f820184b143520527fa900eb1d53900501f71106be05c653f6c2b81534f3801f

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/index2.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date
Fri, 10 Feb 2023 05:09:07 GMT
Content-Encoding
gzip
Last-Modified
Tue, 17 Jan 2023 20:04:12 GMT
Server
Apache
Vary
Accept-Encoding
Transfer-Encoding
chunked
Upgrade
h2,h2c
Content-Type
text/css
Connection
Upgrade, Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=75
blugov.css
correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/css/
69 KB
15 KB
Stylesheet
General
Full URL
http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/css/blugov.css
Requested by
Host: correu.thewealthyplace.org
URL: http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/index2.html
Protocol
HTTP/1.1
Server
204.11.58.229 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
bh-45.webhostbox.net
Software
Apache /
Resource Hash
4217794b756a7de5f436ce268788f5f5ec0d457fbba048d13aa6addf30135b14

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/index2.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date
Fri, 10 Feb 2023 05:09:07 GMT
Content-Encoding
gzip
Last-Modified
Tue, 17 Jan 2023 20:04:22 GMT
Server
Apache
Vary
Accept-Encoding
Upgrade
h2,h2c
Content-Type
text/css
Connection
Upgrade, Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=75
Content-Length
15302
myGov-cobranded-logo-black.svg
correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/css/
63 KB
63 KB
Image
General
Full URL
http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/css/myGov-cobranded-logo-black.svg
Requested by
Host: correu.thewealthyplace.org
URL: http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/index2.html
Protocol
HTTP/1.1
Server
204.11.58.229 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
bh-45.webhostbox.net
Software
Apache /
Resource Hash
954aa858b3bffb8511bc41bc88b07d2b24597c37faf522550e26c9aa3b0d220d

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/index2.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date
Fri, 10 Feb 2023 05:09:08 GMT
Last-Modified
Sat, 03 Dec 2022 18:27:46 GMT
Server
Apache
Upgrade
h2,h2c
Content-Type
image/svg+xml
Connection
Upgrade, Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=75
Content-Length
64143
myGov-cobranded-logo-white.svg
correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/css/
63 KB
63 KB
Image
General
Full URL
http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/css/myGov-cobranded-logo-white.svg
Requested by
Host: correu.thewealthyplace.org
URL: http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/index2.html
Protocol
HTTP/1.1
Server
204.11.58.229 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
bh-45.webhostbox.net
Software
Apache /
Resource Hash
10b11a7c97b90bcf7ad520ac94c5769d08540ce1ee3b84d487c587bf128e3388

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/index2.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date
Fri, 10 Feb 2023 05:09:08 GMT
Last-Modified
Sat, 03 Dec 2022 18:27:46 GMT
Server
Apache
Upgrade
h2,h2c
Content-Type
image/svg+xml
Connection
Upgrade, Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=75
Content-Length
64140
mgv2-vendor.js
correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/css/
0
0
Script
General
Full URL
http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/css/mgv2-vendor.js
Requested by
Host: correu.thewealthyplace.org
URL: http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/index2.html
Protocol
HTTP/1.1
Server
204.11.58.229 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
bh-45.webhostbox.net
Software
Apache /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/index2.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date
Fri, 10 Feb 2023 05:09:07 GMT
Server
Apache
Connection
close
Content-Length
0
Content-Type
text/html; charset=UTF-8
mgv2-application.js
correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/css/
0
0
Script
General
Full URL
http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/css/mgv2-application.js
Requested by
Host: correu.thewealthyplace.org
URL: http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/index2.html
Protocol
HTTP/1.1
Server
204.11.58.229 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
bh-45.webhostbox.net
Software
Apache /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/index2.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date
Fri, 10 Feb 2023 05:09:07 GMT
Server
Apache
Connection
close
Content-Length
0
Content-Type
text/html; charset=UTF-8
login.js
correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/css/
0
0
Script
General
Full URL
http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/css/login.js
Requested by
Host: correu.thewealthyplace.org
URL: http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/index2.html
Protocol
HTTP/1.1
Server
204.11.58.229 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
bh-45.webhostbox.net
Software
Apache /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/index2.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Upgrade
h2,h2c
Date
Fri, 10 Feb 2023 05:09:08 GMT
Server
Apache
Connection
Upgrade, close
Content-Length
0
Content-Type
text/html; charset=UTF-8
blugov-left-chevron-dark.svg
correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/icons/
0
169 B
Image
General
Full URL
http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/icons/blugov-left-chevron-dark.svg
Requested by
Host: correu.thewealthyplace.org
URL: http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/css/blugov.css
Protocol
HTTP/1.1
Server
204.11.58.229 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
bh-45.webhostbox.net
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/css/blugov.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date
Fri, 10 Feb 2023 05:09:08 GMT
Server
Apache
Connection
close
Content-Length
0
Content-Type
text/html; charset=UTF-8
icon-blugov-info.svg
correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/icons/
0
195 B
Image
General
Full URL
http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/icons/icon-blugov-info.svg
Requested by
Host: correu.thewealthyplace.org
URL: http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/css/blugov.css
Protocol
HTTP/1.1
Server
204.11.58.229 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
bh-45.webhostbox.net
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/css/blugov.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Upgrade
h2,h2c
Date
Fri, 10 Feb 2023 05:09:08 GMT
Server
Apache
Connection
Upgrade, close
Content-Length
0
Content-Type
text/html; charset=UTF-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Australian Government (Government)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| oncontentvisibilityautostatechange

0 Cookies

7 Console Messages

Source Level URL
Text
network error URL: http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/css/ruxitagentjs_ICA2Vfghjqrux_10247220811100421.js
Message:
Failed to load resource: the server responded with a status of 500 (Internal Server Error)
network error URL: http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/css/css.css
Message:
Failed to load resource: the server responded with a status of 500 (Internal Server Error)
network error URL: http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/css/mgv2-vendor.js
Message:
Failed to load resource: the server responded with a status of 500 (Internal Server Error)
network error URL: http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/css/mgv2-application.js
Message:
Failed to load resource: the server responded with a status of 500 (Internal Server Error)
network error URL: http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/css/login.js
Message:
Failed to load resource: the server responded with a status of 500 (Internal Server Error)
network error URL: http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/icons/icon-blugov-info.svg
Message:
Failed to load resource: the server responded with a status of 500 (Internal Server Error)
network error URL: http://correu.thewealthyplace.org/204.11.58.229/gov/my.gov.au/icons/blugov-left-chevron-dark.svg
Message:
Failed to load resource: the server responded with a status of 500 (Internal Server Error)