hmrc-councilrxctldvafnrqfies.council-tax-hmrcs.link
Open in
urlscan Pro
8.209.111.35
Malicious Activity!
Public Scan
Effective URL: https://hmrc-councilrxctldvafnrqfies.council-tax-hmrcs.link/council_tax/start-process.php?claim_return_id=HKPutsmDbaDPAEyugBHxdUsPYXHX
Submission: On August 11 via api from US
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on August 10th 2020. Valid for: 3 months.
This is the only time hmrc-councilrxctldvafnrqfies.council-tax-hmrcs.link was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: UK Government (Government)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2606:4700:303... 2606:4700:3033::681b:810e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
7 | 8.209.111.35 8.209.111.35 | 45102 (CNNIC-ALI...) (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co.) | |
7 | 2a04:4e42:1b:... 2a04:4e42:1b::144 | 54113 (FASTLY) (FASTLY) | |
18 | 3 |
ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN)
hmrc-councilrxctldvafnrqfies.council-tax-hmrcs.link |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
service.gov.uk
assets.publishing.service.gov.uk |
3 KB |
7 |
council-tax-hmrcs.link
hmrc-councilrxctldvafnrqfies.council-tax-hmrcs.link |
67 KB |
1 |
zone-anime.net
1 redirects
zone-anime.net |
408 B |
18 | 3 |
Domain | Requested by | |
---|---|---|
7 | assets.publishing.service.gov.uk |
hmrc-councilrxctldvafnrqfies.council-tax-hmrcs.link
|
7 | hmrc-councilrxctldvafnrqfies.council-tax-hmrcs.link |
hmrc-councilrxctldvafnrqfies.council-tax-hmrcs.link
|
1 | zone-anime.net | 1 redirects |
18 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
hmrc-councilidrjewgnyvsdef.council-tax-hmrcs.club Let's Encrypt Authority X3 |
2020-08-10 - 2020-11-08 |
3 months | crt.sh |
www.gov.uk GlobalSign Organization Validation CA - SHA256 - G2 |
2019-04-11 - 2020-11-14 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://hmrc-councilrxctldvafnrqfies.council-tax-hmrcs.link/council_tax/start-process.php?claim_return_id=HKPutsmDbaDPAEyugBHxdUsPYXHX
Frame ID: 276F3963836C2673FDE3277AA64F7CF6
Requests: 18 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://zone-anime.net/poc/115.php
HTTP 302
https://hmrc-councilrxctldvafnrqfies.council-tax-hmrcs.link/council_tax/ Page URL
- https://hmrc-councilrxctldvafnrqfies.council-tax-hmrcs.link/council_tax/start-process.php?claim_return_id=HKPutsmDbaDPAEyugBHxdUsPYXHX Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- url /\.php(?:$|\?)/i
Nginx (Web Servers) Expand
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://zone-anime.net/poc/115.php
HTTP 302
https://hmrc-councilrxctldvafnrqfies.council-tax-hmrcs.link/council_tax/ Page URL
- https://hmrc-councilrxctldvafnrqfies.council-tax-hmrcs.link/council_tax/start-process.php?claim_return_id=HKPutsmDbaDPAEyugBHxdUsPYXHX Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://zone-anime.net/poc/115.php HTTP 302
- https://hmrc-councilrxctldvafnrqfies.council-tax-hmrcs.link/council_tax/
18 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Cookie set
/
hmrc-councilrxctldvafnrqfies.council-tax-hmrcs.link/council_tax/ Redirect Chain
|
114 B 547 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
start-process.php
hmrc-councilrxctldvafnrqfies.council-tax-hmrcs.link/council_tax/ |
23 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
hmr-header.css
hmrc-councilrxctldvafnrqfies.council-tax-hmrcs.link/council_tax/assets/css/ |
17 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
hmr.css
hmrc-councilrxctldvafnrqfies.council-tax-hmrcs.link/council_tax/assets/css/ |
73 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
hmr-btn.min.css
hmrc-councilrxctldvafnrqfies.council-tax-hmrcs.link/council_tax/assets/css/ |
347 KB 40 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
hmrc-councilrxctldvafnrqfies.council-tax-hmrcs.link/council_tax/assets/img/ |
555 B 555 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
start-process.php
hmrc-councilrxctldvafnrqfies.council-tax-hmrcs.link/council_tax/ |
23 KB 5 KB |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
accessible-autocomplete.min-eb4e37c85defbd320f012300c474c80e5b67c81e6303e98813f28803abc0cf8f.css
assets.publishing.service.gov.uk/frontend/accessible-autocomplete/dist/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logotype.png
assets.publishing.service.gov.uk/static/images/ |
0 95 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
search-button-ca89b2a79f944909ceb7370d3f0b78811d32b96e883348fcd8886f63dd619585.png
assets.publishing.service.gov.uk/static/ |
540 B 786 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
bold-a2452cb66f-v1-be83c947da6c602697be56d5f04bab2074ad9e8e7fe39807f814654fd691d328.woff2
assets.publishing.service.gov.uk/frontend/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
light-f38ad40456-v1-b98fe790388f58c950f2bed1ca8ad02fa168d6effa7aae7cb7fee81e51183f46.woff2
assets.publishing.service.gov.uk/frontend/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bullet-disc-5px-e3393763a04698f106321c52befae8f12a9667828004c9f18850aab735a7a577.gif
assets.publishing.service.gov.uk/static/ |
1 KB 1 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon-pointer-e5b47e034536de4f7cb71435f287b8326ea1827a19b8c01507f712503338bd90.png
assets.publishing.service.gov.uk/frontend/ |
0 231 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
open-government-licence-c1aedc8257961b938b4c7a21a2b0db3f2716dd9ef782cea73110dc69107c9042.png
assets.publishing.service.gov.uk/static/images/ |
761 B 868 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
uksdadasadsa.png
assets.publishing.service.gov.uk/static/images/ |
0 96 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
light-458f8ea81c-v1-048b93884a1b51d20f2a3140541d450cb6b82c6c2cf69128ea1d09fdd9699f30.woff
assets.publishing.service.gov.uk/frontend/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
bold-f38c792ac2-v1-01c73d5dd84423dd2fc30aabd1de09a86b36b6de9e2e240d954c09cbb1d97aba.woff
assets.publishing.service.gov.uk/frontend/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- assets.publishing.service.gov.uk
- URL
- https://assets.publishing.service.gov.uk/frontend/bold-a2452cb66f-v1-be83c947da6c602697be56d5f04bab2074ad9e8e7fe39807f814654fd691d328.woff2
- Domain
- assets.publishing.service.gov.uk
- URL
- https://assets.publishing.service.gov.uk/frontend/light-f38ad40456-v1-b98fe790388f58c950f2bed1ca8ad02fa168d6effa7aae7cb7fee81e51183f46.woff2
- Domain
- assets.publishing.service.gov.uk
- URL
- https://assets.publishing.service.gov.uk/frontend/light-458f8ea81c-v1-048b93884a1b51d20f2a3140541d450cb6b82c6c2cf69128ea1d09fdd9699f30.woff
- Domain
- assets.publishing.service.gov.uk
- URL
- https://assets.publishing.service.gov.uk/frontend/bold-f38c792ac2-v1-01c73d5dd84423dd2fc30aabd1de09a86b36b6de9e2e240d954c09cbb1d97aba.woff
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: UK Government (Government)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
hmrc-councilrxctldvafnrqfies.council-tax-hmrcs.link/ | Name: PHPSESSID Value: s7io8mmdlnrouov098c7e7blsa |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
assets.publishing.service.gov.uk
hmrc-councilrxctldvafnrqfies.council-tax-hmrcs.link
zone-anime.net
assets.publishing.service.gov.uk
2606:4700:3033::681b:810e
2a04:4e42:1b::144
8.209.111.35
1d86ad203d9f732075a57918233257f12d7689499451b75db4bf8318b54b50d3
455c1669eb62cabe8847f05d89d0ea213b1af41e2c941311ecd79ff09204da2b
48c87cb8d8fc58a49994ccdff65f19bfc8c482295bbad3ef4c5123237d902d89
6417d1c5816c9bf3e7d4c01bfa8492c229e9a5469234a90fc459757f156f6695
9b9df1c32f5ab789f014e1344b1ea8aa155ad467637072a3baff79977ac793f0
a0d0777267928e03936741f9c02091a76d140388d3b2811db3c4ea047bfa2860
c1aedc8257961b938b4c7a21a2b0db3f2716dd9ef782cea73110dc69107c9042
ca89b2a79f944909ceb7370d3f0b78811d32b96e883348fcd8886f63dd619585
e3393763a04698f106321c52befae8f12a9667828004c9f18850aab735a7a577
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855