nz-file-taxreturn.com Open in urlscan Pro
194.76.225.37  Malicious Activity! Public Scan

URL: https://nz-file-taxreturn.com/nta
Submission: On March 27 via manual from AU — Scanned from NL

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 11 HTTP transactions. The main IP is 194.76.225.37, located in Naaldwijk, Netherlands and belongs to RACKPLACE, DE. The main domain is nz-file-taxreturn.com.
TLS certificate: Issued by R3 on March 27th 2023. Valid for: 3 months.
This is the only time nz-file-taxreturn.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: ASB Bank (Banking) NZ Government (Government)

Domain & IP information

IP Address AS Autonomous System
11 194.76.225.37 58329 (RACKPLACE)
11 2
Apex Domain
Subdomains
Transfer
11 nz-file-taxreturn.com
nz-file-taxreturn.com
527 KB
11 1
Domain Requested by
11 nz-file-taxreturn.com nz-file-taxreturn.com
11 1

This site contains no links.

Subject Issuer Validity Valid
nz-file-taxreturn.com
R3
2023-03-27 -
2023-06-25
3 months crt.sh

This page contains 1 frames:

Primary Page: https://nz-file-taxreturn.com/nta
Frame ID: D617DDD1771097FAD93DDB362EC9CFC2
Requests: 14 HTTP requests in this frame

Screenshot

Page Title

Te Kāwanatanga o Aotearoa

Page Statistics

11
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

581 kB
Transfer

578 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request nta
nz-file-taxreturn.com/
11 KB
11 KB
Document
General
Full URL
https://nz-file-taxreturn.com/nta
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
194.76.225.37 Naaldwijk, Netherlands, ASN58329 (RACKPLACE, DE),
Reverse DNS
Software
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 / PHP/7.4.33
Resource Hash
5afbb5b8c25ce58393af5cfbc84bd1129a675d9efb3f3e7d14af6b07251f42c0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Mon, 27 Mar 2023 05:15:31 GMT
Keep-Alive
timeout=5, max=100
Server
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Transfer-Encoding
chunked
X-Powered-By
PHP/7.4.33
main.css
nz-file-taxreturn.com/assets/nta/
109 KB
109 KB
Stylesheet
General
Full URL
https://nz-file-taxreturn.com/assets/nta/main.css
Requested by
Host: nz-file-taxreturn.com
URL: https://nz-file-taxreturn.com/nta
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
194.76.225.37 Naaldwijk, Netherlands, ASN58329 (RACKPLACE, DE),
Reverse DNS
Software
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 /
Resource Hash
4ba6c16c689f1a59056c4ad87e2e1865dda9a78755997fc03084fa2d7ba6c4a8

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://nz-file-taxreturn.com/nta
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date
Mon, 27 Mar 2023 05:15:31 GMT
Last-Modified
Wed, 24 Aug 2022 13:34:40 GMT
Server
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
ETag
"1b33a-5e6fcbe281c00"
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
111418
logo.svg
nz-file-taxreturn.com/assets/nta/
178 KB
179 KB
Image
General
Full URL
https://nz-file-taxreturn.com/assets/nta/logo.svg
Requested by
Host: nz-file-taxreturn.com
URL: https://nz-file-taxreturn.com/nta
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
194.76.225.37 Naaldwijk, Netherlands, ASN58329 (RACKPLACE, DE),
Reverse DNS
Software
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 /
Resource Hash
5b69a0f8a317419ba7f30a64a6cf97223a2544399eb41717f00410baa2ef4c49

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://nz-file-taxreturn.com/nta
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date
Mon, 27 Mar 2023 05:15:32 GMT
Last-Modified
Wed, 24 Aug 2022 13:33:18 GMT
Server
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
ETag
"2c9e8-5e6fcb944e380"
Content-Type
image/svg+xml
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
182760
truncated
/
11 KB
11 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
586d66aa444adb25f168e3a20649d8f31a4459f9ec19f796d8cc131e46768cfe

Request headers

Referer
Origin
https://nz-file-taxreturn.com
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Content-Type
font/woff2
truncated
/
32 KB
32 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
282da86e1071d060a343341b75391a036a23e28adfc93e879fae9775e45bfd7d

Request headers

Referer
Origin
https://nz-file-taxreturn.com
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Content-Type
font/woff2
truncated
/
11 KB
11 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7bdafffc801054b76371feb4e9d6905b34018d26680e2db4ec2b75bf0f3516d9

Request headers

Referer
Origin
https://nz-file-taxreturn.com
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Content-Type
font/woff2
anz.png
nz-file-taxreturn.com/assets/nta/
4 KB
4 KB
Image
General
Full URL
https://nz-file-taxreturn.com/assets/nta/anz.png
Requested by
Host: nz-file-taxreturn.com
URL: https://nz-file-taxreturn.com/nta
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
194.76.225.37 Naaldwijk, Netherlands, ASN58329 (RACKPLACE, DE),
Reverse DNS
Software
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 /
Resource Hash
7f0ed5425601a8d17185da1e481efdb42da4bc6b518c0b0096089f4acb27b068

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://nz-file-taxreturn.com/nta
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date
Mon, 27 Mar 2023 05:15:32 GMT
Last-Modified
Wed, 24 Aug 2022 13:33:14 GMT
Server
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
ETag
"ea4-5e6fcb907da80"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
3748
bnz.png
nz-file-taxreturn.com/assets/nta/
4 KB
4 KB
Image
General
Full URL
https://nz-file-taxreturn.com/assets/nta/bnz.png
Requested by
Host: nz-file-taxreturn.com
URL: https://nz-file-taxreturn.com/nta
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
194.76.225.37 Naaldwijk, Netherlands, ASN58329 (RACKPLACE, DE),
Reverse DNS
Software
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 /
Resource Hash
9b43b7eb2389af34de87dd534aa3ef80c65614d3a9c26d1945f8f4373f78c554

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://nz-file-taxreturn.com/nta
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date
Mon, 27 Mar 2023 05:15:32 GMT
Last-Modified
Wed, 24 Aug 2022 13:33:10 GMT
Server
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
ETag
"eac-5e6fcb8cad180"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
3756
kiwi.jpg
nz-file-taxreturn.com/assets/nta/
31 KB
32 KB
Image
General
Full URL
https://nz-file-taxreturn.com/assets/nta/kiwi.jpg
Requested by
Host: nz-file-taxreturn.com
URL: https://nz-file-taxreturn.com/nta
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
194.76.225.37 Naaldwijk, Netherlands, ASN58329 (RACKPLACE, DE),
Reverse DNS
Software
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 /
Resource Hash
c03c263c23f5bcc25de2f3216d324cb389f5c1b8543bb52b1e7f0ed483e81928

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://nz-file-taxreturn.com/nta
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date
Mon, 27 Mar 2023 05:15:32 GMT
Last-Modified
Wed, 24 Aug 2022 13:33:06 GMT
Server
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
ETag
"7ccb-5e6fcb88dc880"
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
31947
asb.png
nz-file-taxreturn.com/assets/nta/
99 KB
100 KB
Image
General
Full URL
https://nz-file-taxreturn.com/assets/nta/asb.png
Requested by
Host: nz-file-taxreturn.com
URL: https://nz-file-taxreturn.com/nta
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
194.76.225.37 Naaldwijk, Netherlands, ASN58329 (RACKPLACE, DE),
Reverse DNS
Software
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 /
Resource Hash
20cfe915c43e2028d600e21c95447fd6fd118acfd3436bf98404d72c45c89f62

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://nz-file-taxreturn.com/nta
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date
Mon, 27 Mar 2023 05:15:32 GMT
Last-Modified
Wed, 24 Aug 2022 13:33:00 GMT
Server
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
ETag
"18df4-5e6fcb8323b00"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
101876
coop.png
nz-file-taxreturn.com/assets/nta/
5 KB
5 KB
Image
General
Full URL
https://nz-file-taxreturn.com/assets/nta/coop.png
Requested by
Host: nz-file-taxreturn.com
URL: https://nz-file-taxreturn.com/nta
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
194.76.225.37 Naaldwijk, Netherlands, ASN58329 (RACKPLACE, DE),
Reverse DNS
Software
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 /
Resource Hash
7dc95d128d0424e708f1156a4875a066335d7b0c9faf7e046f1316b6bb44f4a5

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://nz-file-taxreturn.com/nta
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date
Mon, 27 Mar 2023 05:15:32 GMT
Last-Modified
Wed, 24 Aug 2022 13:32:58 GMT
Server
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
ETag
"1379-5e6fcb813b680"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
4985
sbs.png
nz-file-taxreturn.com/assets/nta/
20 KB
21 KB
Image
General
Full URL
https://nz-file-taxreturn.com/assets/nta/sbs.png
Requested by
Host: nz-file-taxreturn.com
URL: https://nz-file-taxreturn.com/nta
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
194.76.225.37 Naaldwijk, Netherlands, ASN58329 (RACKPLACE, DE),
Reverse DNS
Software
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 /
Resource Hash
f7e29046227820828dca701eb525a37bd7325a33d1c1e9c4dee3a233a18baa05

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://nz-file-taxreturn.com/nta
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date
Mon, 27 Mar 2023 05:15:32 GMT
Last-Modified
Wed, 24 Aug 2022 13:32:54 GMT
Server
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
ETag
"51f5-5e6fcb7d6ad80"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
20981
tsb.png
nz-file-taxreturn.com/assets/nta/
4 KB
4 KB
Image
General
Full URL
https://nz-file-taxreturn.com/assets/nta/tsb.png
Requested by
Host: nz-file-taxreturn.com
URL: https://nz-file-taxreturn.com/nta
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
194.76.225.37 Naaldwijk, Netherlands, ASN58329 (RACKPLACE, DE),
Reverse DNS
Software
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 /
Resource Hash
91357ecc89f3a91b7df932f64c9348c2a43443c23c3ce3b10e889b4228bc3a98

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://nz-file-taxreturn.com/nta
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date
Mon, 27 Mar 2023 05:15:32 GMT
Last-Modified
Wed, 24 Aug 2022 13:32:50 GMT
Server
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
ETag
"e83-5e6fcb799a480"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
3715
westpac.png
nz-file-taxreturn.com/assets/nta/
59 KB
59 KB
Image
General
Full URL
https://nz-file-taxreturn.com/assets/nta/westpac.png
Requested by
Host: nz-file-taxreturn.com
URL: https://nz-file-taxreturn.com/nta
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
194.76.225.37 Naaldwijk, Netherlands, ASN58329 (RACKPLACE, DE),
Reverse DNS
Software
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 /
Resource Hash
eda9fb07e8c3fd7c6476407801c2861c937dea801625a140d5c3f8f1e8bbcdd4

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://nz-file-taxreturn.com/nta
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date
Mon, 27 Mar 2023 05:15:32 GMT
Last-Modified
Wed, 24 Aug 2022 13:32:46 GMT
Server
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
ETag
"eae2-5e6fcb75c9b80"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
60130

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ASB Bank (Banking) NZ Government (Government)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless

0 Cookies