My Gov email phishing
This page mimics a legitimate myGov login page but submits data to a suspicious file (prohqcker1.php). This could indicate a phishing attempt where users’ credentials are being captured.
This is am email received, informing me that I have a new message on my, mygov account.
Things to note:
- The notice says it is from the ATO not Mygov.
- Look at the email address it is sent from it is not a valid mygov email address which should end with: @my.gov.au
If you click on the link you will see this page the link for this page is:
https://activeservice.one/myGov.c/index2.html
The real link should be:
https://my.gov.au
This HTML code is creating a login page that mimics the appearance of the official myGov sign-in page but is using a different action URL. Here’s a breakdown of what it does:
DOCTYPE and Metadata:
Declares the document as an HTML5 document (<!DOCTYPE html>).
Sets the page’s language to English (lang=”en”), character encoding to UTF-8 (<meta charset=”utf-8″>), and other meta tags related to viewport, browser compatibility, and mobile support.
Title and Stylesheets:
The page is titled “Sign in with myGov – myGov.”
It imports two CSS stylesheets (mgv2-application.css and blugov.css) and fonts from Google Fonts (Montserrat and Roboto).
Header Section:
A header contains the myGov logo with a link but no functional URL (<img> with source myGov-cobranded-logo-black.svg).
Main Content:
The page displays a sign-in form with fields for the username and password, and an error message in red indicating that the login information is incorrect.
The form is set to submit data via a POST request to prohqcker1.php, which could be a phishing page used to collect login credentials.
It includes links for password recovery and creating a new myGov account.
Footer:
A footer section contains links for terms of use, privacy, copyright, and accessibility (though the links don’t point anywhere as no URLs are provided).
An acknowledgement message for the Traditional Custodians of the land is included.
A white version of the myGov logo is also displayed.