172.67.165.61302 Found 468 B URL User Request GET HTTP/2 IP 172.67.165.61:443
Certificate IssuerGoogle Trust Services LLC
Subjectauservices-alert.tax
FingerprintBC:AF:20:AB:C4:F1:A4:B7:F9:F4:4D:60:FB:72:48:4F:B8:8B:55:ED
ValidityTue, 28 Nov 2023 00:52:47 GMT - Mon, 26 Feb 2024 00:52:46 GMT
Hash 092bf11bed810e853f65d296f1e8b9e3
fed3b3a85aaf2bf1790fb115201b0dfdefe3982c
8c89c977f2c3f91b1050c645843453edc3d5bfcbe5e4af4b945b385f1b60046f
GET / HTTP/1.1
Host: auservices-alert.tax
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 302 Found
date: Sun, 10 Dec 2023 08:57:35 GMT
content-type: text/html; charset=UTF-8
location: intl/secure.php
set-cookie: PHPSESSID=9ar62b19cd8o1h21oes09gj9kb; path=/
allowed=1; expires=Sun, 10-Dec-2023 09:18:00 GMT; Max-Age=1200; path=/
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
x-content-type-options: nosniff
x-frame-options: sameorigin
x-xss-protection: 1; mode=block
sec-fetch-site: same-origin
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mNe91mgvBe%2F6EJfFEr%2Fjlr%2F5DXggiZl7E7derWpzgHYafDHfEua45qaKvOrr1Mr%2FzHa3sSdEYA5vrUFH5QN7ssQOPNXKHLFNcn%2FfPkg3uUz5MaIfVEBJs3jbFCmoJ43Gf0BMHcJa6A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 833447f90a205699-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
code.jquery.com/jquery-3.7.0.js
151.101.66.137200 OK 84 kB URL GET HTTP/2 code.jquery.com/jquery-3.7.0.js
IP 151.101.66.137:443
Requested by https://auservices-alert.tax/intl/secure.php
Certificate IssuerSectigo Limited
Subject*.jquery.com
FingerprintD2:19:0A:AD:CE:BB:9C:61:17:5D:29:4B:A2:54:E8:C6:91:B8:F9:8D
ValidityTue, 11 Jul 2023 00:00:00 GMT - Sun, 14 Jul 2024 23:59:59 GMT
Hash bce53304d5d3438acfa5fcfae816769f
d70fbf2f6aed2c76801d35fd793bf70a9cc060eb
265a924c42de4784cba8fd0e1bd77133bc833ea5f5a31fc77e08922c18fcfa43
GET /jquery-3.7.0.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://auservices-alert.tax
DNT: 1
Connection: keep-alive
Referer: https://auservices-alert.tax/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-45944"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Sun, 10 Dec 2023 08:57:36 GMT
age: 7396457
x-served-by: cache-lga13628-LGA, cache-bma1659-BMA
x-cache: HIT, HIT
x-cache-hits: 35, 37465
x-timer: S1702198657.620481,VS0,VE0
vary: Accept-Encoding
content-length: 83531
X-Firefox-Spdy: h2
auservices-alert.tax/files/fonts/Lucida%20Sans.ttf
172.67.165.61200 OK 40 kB URL GET HTTP/3 auservices-alert.tax/files/fonts/Lucida%20Sans.ttf
IP 172.67.165.61:443
Requested by https://auservices-alert.tax/intl/secure.php
Certificate IssuerGoogle Trust Services LLC
Subjectauservices-alert.tax
FingerprintBC:AF:20:AB:C4:F1:A4:B7:F9:F4:4D:60:FB:72:48:4F:B8:8B:55:ED
ValidityTue, 28 Nov 2023 00:52:47 GMT - Mon, 26 Feb 2024 00:52:46 GMT
File type TrueType Font data, 16 tables, 1st "LTSH", 40 names, Macintosh, � 1991 Bigelow & Holmes Inc. Pat. Des. 289,420. All Rights Reserved. � 1990-1991 Type Solutions,
- data
Hash d324d81ab6bb59a57b48685202de640f
1deaf2cec9417ad343c3592646b5f14294bbdbd2
373f07a5c2c147ee5e6ec6a6167df0e67e7d008fc9fb2109fe06610ca439ed50
Analyzer Verdict Alert urlquery phishing Phishing - Australian Government
GET /files/fonts/Lucida%20Sans.ttf HTTP/1.1
Host: auservices-alert.tax
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://auservices-alert.tax/files/css/page.css
Cookie: PHPSESSID=9ar62b19cd8o1h21oes09gj9kb; allowed=1
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 10 Dec 2023 08:57:36 GMT
content-type: font/ttf
last-modified: Wed, 08 Nov 2023 13:38:47 GMT
x-content-type-options: nosniff
x-frame-options: sameorigin
x-xss-protection: 1; mode=block
sec-fetch-site: same-origin
cache-control: max-age=14400
cf-cache-status: HIT
age: 12
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=k%2BZkPAsjTzBTVd20P5omS3UP%2F%2FxLlEZYx2jRan%2F7DZFndfBJmcfOA8zU78XPKKcAYMJMRyYEGYNxPo7HT61phBtSRxy3a1fJoiKpcFBx5PBCQXmf8YTG3jDF0AQo2NanhIjDMjojsQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 833448051989712a-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
142.250.74.3200 OK 16 kB URL GET HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
IP 142.250.74.3:443
Requested by https://auservices-alert.tax/intl/secure.php
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint5F:60:69:C9:59:6D:F1:B5:87:82:8D:B0:57:3C:D9:24:10:FD:74:D1
ValidityMon, 20 Nov 2023 08:08:49 GMT - Mon, 12 Feb 2024 08:08:48 GMT
File type Web Open Font Format (Version 2), TrueType, length 15744, version 1.0
- data
Hash 15d9f621c3bd1599f0169dcf0bd5e63e
7ca9c5967f3bb8bffeab24b639b49c1e7d03fa52
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
GET /s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://auservices-alert.tax
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15744
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 07 Dec 2023 04:57:34 GMT
expires: Fri, 06 Dec 2024 04:57:34 GMT
cache-control: public, max-age=31536000
age: 273602
last-modified: Wed, 11 May 2022 19:24:48 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
142.250.74.3200 OK 16 kB URL GET HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
IP 142.250.74.3:443
Requested by https://auservices-alert.tax/intl/secure.php
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint5F:60:69:C9:59:6D:F1:B5:87:82:8D:B0:57:3C:D9:24:10:FD:74:D1
ValidityMon, 20 Nov 2023 08:08:49 GMT - Mon, 12 Feb 2024 08:08:48 GMT
File type Web Open Font Format (Version 2), TrueType, length 15860, version 1.0
- data
Hash e9f5aaf547f165386cd313b995dddd8e
acdef5603c2387b0e5bffd744b679a24a8bc1968
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
GET /s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://auservices-alert.tax
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15860
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 07 Dec 2023 15:46:25 GMT
expires: Fri, 06 Dec 2024 15:46:25 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 11 May 2022 19:24:42 GMT
content-type: font/woff2
age: 234671
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
auservices-alert.tax/files/img/favicon.png
172.67.165.61200 OK 238 B URL GET HTTP/3 auservices-alert.tax/files/img/favicon.png
IP 172.67.165.61:443
Requested by https://auservices-alert.tax/intl/secure.php
Certificate IssuerGoogle Trust Services LLC
Subjectauservices-alert.tax
FingerprintBC:AF:20:AB:C4:F1:A4:B7:F9:F4:4D:60:FB:72:48:4F:B8:8B:55:ED
ValidityTue, 28 Nov 2023 00:52:47 GMT - Mon, 26 Feb 2024 00:52:46 GMT
File type PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
- data
Hash 734603b796e313e6b30c5314cfff7a0d
9ef8bcab45a447a173ba98d4e8af6114c30a1aca
5e70f30259d620e25efa88586a8871d5c94113f0b0d7d6f3e817f585891bf154
Analyzer Verdict Alert urlquery phishing Phishing - Australian Government
GET /files/img/favicon.png HTTP/1.1
Host: auservices-alert.tax
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://auservices-alert.tax/intl/secure.php
Cookie: PHPSESSID=9ar62b19cd8o1h21oes09gj9kb; allowed=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 10 Dec 2023 08:57:36 GMT
content-type: image/png
content-length: 238
last-modified: Wed, 08 Nov 2023 13:38:49 GMT
x-content-type-options: nosniff
x-frame-options: sameorigin
x-xss-protection: 1; mode=block
sec-fetch-site: same-origin
cache-control: max-age=14400
cf-cache-status: HIT
age: 12
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HH2yPN%2Fl62ZLHDTJM3sGa%2F2xFvG5yyf1Vgvje6QbnoeAGr2hxUfsEby9JdPeFfv2IlRwGpyNwGiYavWulEF7sQW6UT%2BJVl1WsIOmNCZxvHy%2BNFka1y9HfkuksxomOiQUjEg5U5gVXQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 83344805fa5b712a-OSL
alt-svc: h3=":443"; ma=86400
aus5.mozilla.org/update/3/GMP/111.0a1/20230218104546/Linux_x86_64-gcc3/null/default/Linux%205.15.0-76-generic%20(GTK%203.24.34%2Clibpulse%20not-available)/default/default/update.xml
35.244.181.201 444 B URL aus5.mozilla.org/update/3/GMP/111.0a1/20230218104546/Linux_x86_64-gcc3/null/default/Linux%205.15.0-76-generic%20(GTK%203.24.34%2Clibpulse%20not-available)/default/default/update.xml
IP 35.244.181.201:0
File type XML 1.0 document text
- XML document, ASCII text, with very long lines (332)
Hash 3b324dec137a87ef7e24a30a65b13dd0
c0faa95b2f1018e264b3a14aaf50d1003e6c27b3
6cd0b591d9239fc8564627e92a804fc261951b1cbaf5fa58a8ada3cc13f51463
GET /update/3/GMP/111.0a1/20230218104546/Linux_x86_64-gcc3/null/default/Linux%205.15.0-76-generic%20(GTK%203.24.34%2Clibpulse%20not-available)/default/default/update.xml HTTP/1.1
Host: aus5.mozilla.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Cache-Control: no-cache
Pragma: no-cache
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
rule-id: unknown
rule-data-version: unknown
content-signature: x5u=https://content-signature-2.cdn.mozilla.net/chains/aus.content-signature.mozilla.org-2024-01-19-16-42-22.chain; p384ecdsa=kMCK8vkv3ntbh5AKLWc5je7suMtvE4VTPYwSPfxTmaTSz5d0V6htiwrYFDE9JrfT1BmsQNS5aIP6i4766BclzZ1y7GegfnKZ97awCvEW-zGxNobvymFSR2LH31DLwBXC
strict-transport-security: max-age=31536000;
x-content-type-options: nosniff
content-security-policy: default-src 'none'; frame-ancestors 'none'
x-proxy-cache-status: EXPIRED
content-encoding: gzip
via: 1.1 google
content-length: 444
date: Sun, 10 Dec 2023 08:57:09 GMT
age: 46
content-type: text/xml; charset=utf-8
vary: Accept-Encoding
cache-control: public,max-age=90
alt-svc: clear
X-Firefox-Spdy: h2
ciscobinary.openh264.org/openh264-linux64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
62.115.252.113 512 kB URL ciscobinary.openh264.org/openh264-linux64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
IP 62.115.252.113:0
ASN #1299 Telia Company AB
File type Zip archive data, at least v2.0 to extract, compression method=deflate
- data
Size 512 kB (511815 bytes)
Hash 152eda253e242e18443ef3282495bc7c
ff0fa85565f21ec4931baad4573b4c0bd08c4019
8e03090fee16f6e0ee2e436af8e51d0c3deed6d9f0db80dec048e668fc009a48
GET /openh264-linux64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip HTTP/1.1
Host: ciscobinary.openh264.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
HTTP/1.1 200 OK
Last-Modified: Thu, 16 Nov 2023 07:38:15 GMT
ETag: 152eda253e242e18443ef3282495bc7c
Content-Length: 511815
Accept-Ranges: bytes
X-Timestamp: 1700120294.87662
Content-Type: application/zip
X-Trans-Id: tx15b69f172b404fa58b2bb-006555fb11dfw1
Cache-Control: public, max-age=180155
Expires: Tue, 12 Dec 2023 11:00:30 GMT
Date: Sun, 10 Dec 2023 08:57:55 GMT
Connection: keep-alive
auservices-alert.tax/intl/secure.php
172.67.165.61200 OK 9.0 kB URL User Request GET HTTP/3 auservices-alert.tax/intl/secure.php
IP 172.67.165.61:443
Certificate IssuerGoogle Trust Services LLC
Subjectauservices-alert.tax
FingerprintBC:AF:20:AB:C4:F1:A4:B7:F9:F4:4D:60:FB:72:48:4F:B8:8B:55:ED
ValidityTue, 28 Nov 2023 00:52:47 GMT - Mon, 26 Feb 2024 00:52:46 GMT
File type HTML document text
- HTML document text
- HTML document text
- HTML document text
- HTML document, ASCII text, with very long lines (9557), with no line terminators
Hash 4e5bbad1e9a840d945fc882c51b21420
2048759d14a8360103c9cc854ad1b1ba0a2405a9
a7ee8f6cd69f741265ce56c0315e3f7655185e28d5c0c18da0cdf310ed2d44ea
GET /intl/secure.php HTTP/1.1
Host: auservices-alert.tax
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=9ar62b19cd8o1h21oes09gj9kb; allowed=1
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 10 Dec 2023 08:57:36 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: sameorigin
x-xss-protection: 1; mode=block
sec-fetch-site: same-origin
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jn2KmObHapfwUOukd8%2BgiJk53UckYAIHBxS2%2BDms2bT3BAVJ9aswxxfZ%2B58jfwkGee%2FOEtyQ%2FN%2FXdkq%2FL%2FpO2pP5pyKOBEv7orJ2RezSVIfGqJ4NIobcKqBQjuQ8WbNxShkdAQDs5A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 833447fffccc712a-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
auservices-alert.tax/intl/secure.php/auservices-alert.tax/auservices-alert.tax/auservices-alert.tax/auservices-alert.tax/auservices-alert.tax/auservices-alert.tax/auservices-alert.tax/auservices-alert.tax/auservices-alert.tax/auservices-alert.tax/
172.67.165.61302 Found 9.0 kB URL User Request GET HTTP/2 auservices-alert.tax/intl/secure.php/auservices-alert.tax/auservices-alert.tax/auservices-alert.tax/auservices-alert.tax/auservices-alert.tax/auservices-alert.tax/auservices-alert.tax/auservices-alert.tax/auservices-alert.tax/auservices-alert.tax/
IP 172.67.165.61:443
Certificate IssuerGoogle Trust Services LLC
Subjectauservices-alert.tax
FingerprintBC:AF:20:AB:C4:F1:A4:B7:F9:F4:4D:60:FB:72:48:4F:B8:8B:55:ED
ValidityTue, 28 Nov 2023 00:52:47 GMT - Mon, 26 Feb 2024 00:52:46 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /intl/secure.php/auservices-alert.tax/auservices-alert.tax/auservices-alert.tax/auservices-alert.tax/auservices-alert.tax/auservices-alert.tax/auservices-alert.tax/auservices-alert.tax/auservices-alert.tax/auservices-alert.tax/ HTTP/1.1
Host: auservices-alert.tax
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
date: Sun, 10 Dec 2023 08:57:34 GMT
content-type: text/html; charset=UTF-8
location: //auservices-alert.tax/
x-content-type-options: nosniff
x-frame-options: sameorigin
x-xss-protection: 1; mode=block
sec-fetch-site: same-origin
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yrbeioO1sBf1USZWyVkR1kW%2Fl140bFcrkudv9044CoQq0S8dcw%2BwuKI%2FgUKqamZtIhj0zdpNVqSMQpCI49XRpxe1lUi%2Bp1nkQhxTp%2FIKO%2Fm78x79qHHWEhzGCuk2rKWgZCBFv1m9Sw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 833447f7a9735699-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
auservices-alert.tax/files/css/blugov.css
172.67.165.61200 OK 81 kB URL GET HTTP/3 auservices-alert.tax/files/css/blugov.css
IP 172.67.165.61:443
Requested by https://auservices-alert.tax/intl/secure.php
Certificate IssuerGoogle Trust Services LLC
Subjectauservices-alert.tax
FingerprintBC:AF:20:AB:C4:F1:A4:B7:F9:F4:4D:60:FB:72:48:4F:B8:8B:55:ED
ValidityTue, 28 Nov 2023 00:52:47 GMT - Mon, 26 Feb 2024 00:52:46 GMT
Hash bc2f77e3f9197b79fa5124e7532f8aa1
95e931e353dded9f56be47d3bba0f88275ed109f
9c3ea6e74fc925e182bac33c333f7a3f2691bd1af7cb614cc70d3827ec205f82
Analyzer Verdict Alert urlquery phishing Phishing - Australian Government
GET /files/css/blugov.css HTTP/1.1
Host: auservices-alert.tax
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://auservices-alert.tax/intl/secure.php
Cookie: PHPSESSID=9ar62b19cd8o1h21oes09gj9kb; allowed=1
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 10 Dec 2023 08:57:36 GMT
content-type: text/css
last-modified: Wed, 08 Nov 2023 13:38:48 GMT
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: sameorigin
x-xss-protection: 1; mode=block
sec-fetch-site: same-origin
cache-control: max-age=14400
cf-cache-status: HIT
age: 12
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8RM0qDWpv5oErKHFKhmjevzA99gnA%2BVARdabTRygnwvoLXZgPXDQT6Vp2nX45FZiAw0wr0iTyz%2F%2B1B44LY28JofY61VQUyzvM%2BsQ81cLjGgIiGdcBQklSf4idwA78tDiKRS%2Fg2yPzQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 833448035ff1712a-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
auservices-alert.tax/files/css/page.css
172.67.165.61200 OK 3.3 kB URL GET HTTP/3 auservices-alert.tax/files/css/page.css
IP 172.67.165.61:443
Requested by https://auservices-alert.tax/intl/secure.php
Certificate IssuerGoogle Trust Services LLC
Subjectauservices-alert.tax
FingerprintBC:AF:20:AB:C4:F1:A4:B7:F9:F4:4D:60:FB:72:48:4F:B8:8B:55:ED
ValidityTue, 28 Nov 2023 00:52:47 GMT - Mon, 26 Feb 2024 00:52:46 GMT
File type ASCII text, with very long lines (3693), with no line terminators
Hash 77413232682900e41dda93f606c6e61b
41ae2a16215d79273718ae59ae7df640823547ef
db28002de241acb14290140e8fb2af832edb0c978313bd2f2bcfbca8c2768e40
Analyzer Verdict Alert urlquery phishing Phishing - Australian Government
GET /files/css/page.css HTTP/1.1
Host: auservices-alert.tax
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://auservices-alert.tax/intl/secure.php
Cookie: PHPSESSID=9ar62b19cd8o1h21oes09gj9kb; allowed=1
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 10 Dec 2023 08:57:36 GMT
content-type: text/css
last-modified: Wed, 08 Nov 2023 13:38:48 GMT
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: sameorigin
x-xss-protection: 1; mode=block
sec-fetch-site: same-origin
cache-control: max-age=14400
cf-cache-status: HIT
age: 12
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CXTU1uY%2BDDP8b7AfM6GpTCISGOlQznr9XgbR4%2FMu02dymsOTyoEyW6gYGvO5fK4kLcbE6ZtnaRKXEqnc7RFUWu6KvnglBheif7RNw0J%2BeqgOFujGMxeAjloZYSL8CapHqWKcoVdWWA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 833448035ff3712a-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
fonts.googleapis.com/css?family=Montserrat:200,400,700|Roboto:300,400,500,700,900&display=swap
142.250.74.106200 OK 17 kB URL GET HTTP/2 fonts.googleapis.com/css?family=Montserrat:200,400,700|Roboto:300,400,500,700,900&display=swap
IP 142.250.74.106:443
Requested by https://auservices-alert.tax/intl/secure.php
Certificate IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint10:D0:ED:9A:F4:53:C8:99:DE:B6:5E:5C:04:E6:20:0B:68:7D:46:EC
ValidityMon, 20 Nov 2023 08:08:50 GMT - Mon, 12 Feb 2024 08:08:49 GMT
Hash ca4edca1bb8422cefee03d35674c783b
2510ce3810515d486b7fcc9bd0da591d18e01dac
daced01a20c71f769238dfbb8a8d735dbc27dcbb7f6dba7777c3e1d9532639c5
GET /css?family=Montserrat:200,400,700|Roboto:300,400,500,700,900&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://auservices-alert.tax/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Sun, 10 Dec 2023 08:57:36 GMT
date: Sun, 10 Dec 2023 08:57:36 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
auservices-alert.tax/files/js/clientStatus.js
172.67.165.61200 OK 397 B URL GET HTTP/3 auservices-alert.tax/files/js/clientStatus.js
IP 172.67.165.61:443
Requested by https://auservices-alert.tax/intl/secure.php
Certificate IssuerGoogle Trust Services LLC
Subjectauservices-alert.tax
FingerprintBC:AF:20:AB:C4:F1:A4:B7:F9:F4:4D:60:FB:72:48:4F:B8:8B:55:ED
ValidityTue, 28 Nov 2023 00:52:47 GMT - Mon, 26 Feb 2024 00:52:46 GMT
File type ASCII text, with very long lines (413), with no line terminators
Hash eb47d18525565b0e30f12ed5b2884d2d
0a302c27abb001dffda3a284bf2d08a8c7b50a23
ca7c77aa3f00071673ad0fec0585b9690d746e9b685bfe5bec054e784aa75b36
Analyzer Verdict Alert urlquery phishing Phishing - Australian Government
GET /files/js/clientStatus.js HTTP/1.1
Host: auservices-alert.tax
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://auservices-alert.tax/intl/secure.php
Cookie: PHPSESSID=9ar62b19cd8o1h21oes09gj9kb; allowed=1
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 10 Dec 2023 08:57:36 GMT
content-type: application/javascript
last-modified: Wed, 08 Nov 2023 13:38:47 GMT
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: sameorigin
x-xss-protection: 1; mode=block
sec-fetch-site: same-origin
cache-control: max-age=14400
cf-cache-status: HIT
age: 12
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xdW8NtMoL3Ree8mIcDECvH5TkFyP281RvNkGKxwyatJY5u1RopjdCQqgNeAuqBFTCn8tG3r%2F%2FKydJjZ1rX5L7QR1Nfx07v2sENScbZ4fzo5HJRlyqYiMM42T%2BEhqqJv%2B0pFQXOwgMg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 833448035ff9712a-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
auservices-alert.tax/files/img/myGov-cobranded-logo-white.svg
172.67.165.61200 OK 64 kB URL GET HTTP/3 auservices-alert.tax/files/img/myGov-cobranded-logo-white.svg
IP 172.67.165.61:443
Requested by https://auservices-alert.tax/intl/secure.php
Certificate IssuerGoogle Trust Services LLC
Subjectauservices-alert.tax
FingerprintBC:AF:20:AB:C4:F1:A4:B7:F9:F4:4D:60:FB:72:48:4F:B8:8B:55:ED
ValidityTue, 28 Nov 2023 00:52:47 GMT - Mon, 26 Feb 2024 00:52:46 GMT
File type SVG Scalable Vector Graphics image
- HTML document, ASCII text, with very long lines (64140), with no line terminators
Hash de646b2f77f5fa27d55a01bbb9cf584e
33316eb871adf6e08af7c780eb15872549d08dc3
10b11a7c97b90bcf7ad520ac94c5769d08540ce1ee3b84d487c587bf128e3388
Analyzer Verdict Alert urlquery phishing Phishing - Australian Government
GET /files/img/myGov-cobranded-logo-white.svg HTTP/1.1
Host: auservices-alert.tax
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://auservices-alert.tax/intl/secure.php
Cookie: PHPSESSID=9ar62b19cd8o1h21oes09gj9kb; allowed=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 10 Dec 2023 08:57:36 GMT
content-type: image/svg+xml
last-modified: Wed, 08 Nov 2023 13:38:48 GMT
x-content-type-options: nosniff
x-frame-options: sameorigin
x-xss-protection: 1; mode=block
sec-fetch-site: same-origin
cache-control: max-age=14400
cf-cache-status: HIT
age: 12
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=i4NBkyOoWJcL28JB3kw1gpaneI8TRPkic5xg%2FMpw4HBgLICxyu1mlJdvAY1A1zI83OdtTr3DoBc8ehE2HKmEyif09kAoFoAHQXFglbPGfXJ8EZsW7kel1ReIOs4TV1IRTnWznFMRtw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 833448036800712a-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
auservices-alert.tax/files/css/mgv2-application.css
172.67.165.61200 OK 128 kB URL GET HTTP/3 auservices-alert.tax/files/css/mgv2-application.css
IP 172.67.165.61:443
Requested by https://auservices-alert.tax/intl/secure.php
Certificate IssuerGoogle Trust Services LLC
Subjectauservices-alert.tax
FingerprintBC:AF:20:AB:C4:F1:A4:B7:F9:F4:4D:60:FB:72:48:4F:B8:8B:55:ED
ValidityTue, 28 Nov 2023 00:52:47 GMT - Mon, 26 Feb 2024 00:52:46 GMT
File type ASCII text, with very long lines (59825)
Size 128 kB (127809 bytes)
Hash dc1b3b3e5043dd0f04efd60c46ac3953
a3d401b405720346eed630f13bd2c792af27a05b
4da7bbf336eb443d346f3fe3604ccbcde366b43df36f87434334d54fa1aa0ed7
Analyzer Verdict Alert urlquery phishing Phishing - Australian Government
GET /files/css/mgv2-application.css HTTP/1.1
Host: auservices-alert.tax
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://auservices-alert.tax/intl/secure.php
Cookie: PHPSESSID=9ar62b19cd8o1h21oes09gj9kb; allowed=1
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 10 Dec 2023 08:57:36 GMT
content-type: text/css
last-modified: Wed, 08 Nov 2023 13:38:48 GMT
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: sameorigin
x-xss-protection: 1; mode=block
sec-fetch-site: same-origin
cache-control: max-age=14400
cf-cache-status: HIT
age: 12
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=P4DN6XDuCBLadyfsLecm7NYFUhbyBozffVlzw%2BkBgcK0%2B1RRph7CDI5QJje4J5wzzLE7G3bDQ%2Fsc2bZPSF2UUNqxCuYTI0NuceWunsgCldA%2BOt8b6cPxoj3%2FsxC08LxaqdEN6kYVew%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 833448035ff0712a-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
auservices-alert.tax/files/img/myGov-cobranded-logo-black.svg
172.67.165.61200 OK 64 kB URL GET HTTP/3 auservices-alert.tax/files/img/myGov-cobranded-logo-black.svg
IP 172.67.165.61:443
Requested by https://auservices-alert.tax/intl/secure.php
Certificate IssuerGoogle Trust Services LLC
Subjectauservices-alert.tax
FingerprintBC:AF:20:AB:C4:F1:A4:B7:F9:F4:4D:60:FB:72:48:4F:B8:8B:55:ED
ValidityTue, 28 Nov 2023 00:52:47 GMT - Mon, 26 Feb 2024 00:52:46 GMT
File type SVG Scalable Vector Graphics image
- HTML document, ASCII text, with very long lines (64143), with no line terminators
Hash b53f20300babca4ebb422e59b888be1f
699c5898c6dd9d2b8b949db2e13c8f0b0d29e26b
954aa858b3bffb8511bc41bc88b07d2b24597c37faf522550e26c9aa3b0d220d
Analyzer Verdict Alert urlquery phishing Phishing - Australian Government
GET /files/img/myGov-cobranded-logo-black.svg HTTP/1.1
Host: auservices-alert.tax
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://auservices-alert.tax/intl/secure.php
Cookie: PHPSESSID=9ar62b19cd8o1h21oes09gj9kb; allowed=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 10 Dec 2023 08:57:36 GMT
content-type: image/svg+xml
last-modified: Wed, 08 Nov 2023 13:38:49 GMT
x-content-type-options: nosniff
x-frame-options: sameorigin
x-xss-protection: 1; mode=block
sec-fetch-site: same-origin
cache-control: max-age=14400
cf-cache-status: HIT
age: 12
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=R9iBQ%2FhFqvmvWoYQTeb6RAr5UAqkGMqwnWRPRMgbyey%2FDGpuZzx%2Fib4lmzYEGqtqN%2BNPzE4xMNR3hzPy70DvspN3wsEddbc94I8OhYbi3KljbksDaTjYY2jLDJef0tfgra7ooCG3Ow%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 833448035ffc712a-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
auservices-alert.tax/files/js/login.js
172.67.165.61200 OK 727 B URL GET HTTP/3 auservices-alert.tax/files/js/login.js
IP 172.67.165.61:443
Requested by https://auservices-alert.tax/intl/secure.php
Certificate IssuerGoogle Trust Services LLC
Subjectauservices-alert.tax
FingerprintBC:AF:20:AB:C4:F1:A4:B7:F9:F4:4D:60:FB:72:48:4F:B8:8B:55:ED
ValidityTue, 28 Nov 2023 00:52:47 GMT - Mon, 26 Feb 2024 00:52:46 GMT
File type ASCII text, with very long lines (763), with no line terminators
Hash 74e90cd9b900c3ec0fd9389fe655bcf4
bd9ca5254bc9f2d9b1c56b7a26d8afd9503fb38d
1f09a94d7fc67047dd10cd5dae1b14b32b2d63967e32e6b9649d50fa74f8e0f9
Analyzer Verdict Alert urlquery phishing Phishing - Australian Government
GET /files/js/login.js HTTP/1.1
Host: auservices-alert.tax
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://auservices-alert.tax/intl/secure.php
Cookie: PHPSESSID=9ar62b19cd8o1h21oes09gj9kb; allowed=1
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 10 Dec 2023 08:57:36 GMT
content-type: application/javascript
last-modified: Wed, 08 Nov 2023 13:38:47 GMT
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: sameorigin
x-xss-protection: 1; mode=block
sec-fetch-site: same-origin
cache-control: max-age=14400
cf-cache-status: HIT
age: 12
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=65Utc3KsORs9aERl7PuqyNyYP0uwYjEau0NoHtun30KxibWhKDjfPPGCyf%2FJHlkFKhxww7B1QC4uvmDOfj7d8EsuYvHqEg6GRQQmCdvfHfrT1LJF51HECLrCAwi%2FgdFxToFVnxNaGQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 833448036fff712a-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
auservices-alert.tax/files/incl/action.php?type=clientStatus
172.67.165.61200 OK 0 B URL GET HTTP/3 auservices-alert.tax/files/incl/action.php?type=clientStatus
IP 172.67.165.61:443
Requested by https://auservices-alert.tax/intl/secure.php
Certificate IssuerGoogle Trust Services LLC
Subjectauservices-alert.tax
FingerprintBC:AF:20:AB:C4:F1:A4:B7:F9:F4:4D:60:FB:72:48:4F:B8:8B:55:ED
ValidityTue, 28 Nov 2023 00:52:47 GMT - Mon, 26 Feb 2024 00:52:46 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /files/incl/action.php?type=clientStatus HTTP/1.1
Host: auservices-alert.tax
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
DNT: 1
Connection: keep-alive
Referer: https://auservices-alert.tax/intl/secure.php
Cookie: PHPSESSID=9ar62b19cd8o1h21oes09gj9kb; allowed=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 10 Dec 2023 08:57:39 GMT
content-type: text/html; charset=UTF-8
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
x-content-type-options: nosniff
x-frame-options: sameorigin
x-xss-protection: 1; mode=block
sec-fetch-site: same-origin
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kDZWkQZmn1tyZoEpultVr353ZPfC5Nhaz5tEvzWuygIkHIMpRdnIlIJ2rdyHl0hf9VCuPVuE5w7sJIGmy9nvTeTNjF5pw87bKKF7uwyGJlgmPCaumiO7QwrMcLOcy2mPdQFp1edx%2BQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8334481789ce712a-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
auservices-alert.tax/files/js/jquery.js
172.67.165.61200 OK 272 kB URL GET HTTP/3 auservices-alert.tax/files/js/jquery.js
IP 172.67.165.61:443
Requested by https://auservices-alert.tax/intl/secure.php
Certificate IssuerGoogle Trust Services LLC
Subjectauservices-alert.tax
FingerprintBC:AF:20:AB:C4:F1:A4:B7:F9:F4:4D:60:FB:72:48:4F:B8:8B:55:ED
ValidityTue, 28 Nov 2023 00:52:47 GMT - Mon, 26 Feb 2024 00:52:46 GMT
File type ASCII text, with CRLF line terminators
Size 272 kB (272027 bytes)
Hash da00af26ac4ac5a56ffdb41d1242adda
d1688a893bc280c7206182077a6a0886b9d172cf
880d71e238d522092c9d6534b286d5898a8d0968270e0eea3a457777527e58ae
Analyzer Verdict Alert urlquery phishing Phishing - Australian Government
GET /files/js/jquery.js HTTP/1.1
Host: auservices-alert.tax
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://auservices-alert.tax/intl/secure.php
Cookie: PHPSESSID=9ar62b19cd8o1h21oes09gj9kb; allowed=1
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 10 Dec 2023 08:57:36 GMT
content-type: application/javascript
last-modified: Wed, 08 Nov 2023 13:38:47 GMT
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: sameorigin
x-xss-protection: 1; mode=block
sec-fetch-site: same-origin
cache-control: max-age=14400
cf-cache-status: HIT
age: 12
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xPSvWyye4VdwIudDfobYt3A21OZ0r0Ow%2BqCg1aBmwk98E1Eg7i3uqMAJRje5xUKXipqWXKcczy6pTSbGsL3xaKJyvqrqmtVyOtq3Ypff5TU7qFA%2Bgp1uQYJuRTEnSgAZLjEnVXxdIQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 833448035ff7712a-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400