urlscan.io logo urlscan.io
SecurityTrails logo

forstcontrol.ch Open in urlscan Pro
2a01:ab20:0:203::15  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://forstcontrol.ch/info/wp-content/themes/twentynineteen/inc/js/GOV/
Submission: On January 31 via manual from GB
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 7 IPs in 3 countries across 4 domains to perform 17 HTTP transactions. The main IP is 2a01:ab20:0:203::15, located in Switzerland and belongs to CYON, CH. The main domain is forstcontrol.ch.
TLS certificate: Issued by R3 on January 19th 2021. Valid for: 3 months.
This is the only time forstcontrol.ch was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: UK Government (Government)

Domain & IP information

3    2a01:ab20:0:203::15 (Switzerland)

ASN47302 (CYON, CH)
forstcontrol.ch
10    104.109.90.232 (Netherlands)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a104-109-90-232.deploy.static.akamaitechnologies.com
www.tax.service.gov.uk
1    2a00:1450:4001:811::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    2a00:1450:4001:808::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    2a00:1450:4001:811::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
2    2a00:1450:4001:812::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
Domain Requested by
10 www.tax.service.gov.uk forstcontrol.ch
www.tax.service.gov.uk
3 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
3 forstcontrol.ch 1 redirects forstcontrol.ch
2 www.googletagmanager.com www.tax.service.gov.uk
www.googletagmanager.com
17 4

This site contains links to these domains. Also see Links.

Domain
www.gov.uk
www.tax.service.gov.uk
www.nationalarchives.gov.uk
Subject Issuer Validity Valid
forstcontrol.ch
R3		 2021-01-19 -
2021-04-19		 3 months crt.sh
online.hmrc.gov.uk
DigiCert SHA2 Extended Validation Server CA		 2020-12-22 -
2021-04-15		 4 months crt.sh
*.google-analytics.com
GTS CA 1O1		 2021-01-05 -
2021-03-30		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://forstcontrol.ch/info/wp-content/themes/twentynineteen/inc/js/GOV/
Frame ID: D0B0E883EB0F79750BF0806C6454C478
Requests: 19 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://forstcontrol.ch/info/wp-content/themes/twentynineteen/inc/js/GOV HTTP 301
    https://forstcontrol.ch/info/wp-content/themes/twentynineteen/inc/js/GOV/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Overall confidence: 100%
Detected patterns
  • script /([\d.]+)?\/modernizr(?:.([\d.]+))?.*\.js/i

Page Statistics

17
Requests

100 %
HTTPS

83 %
IPv6

4
Domains

4
Subdomains

7
IPs

3
Countries

611 kB
Transfer

1258 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://forstcontrol.ch/info/wp-content/themes/twentynineteen/inc/js/GOV HTTP 301
    https://forstcontrol.ch/info/wp-content/themes/twentynineteen/inc/js/GOV/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
forstcontrol.ch/info/wp-content/themes/twentynineteen/inc/js/GOV/
Redirect Chain
  • https://forstcontrol.ch/info/wp-content/themes/twentynineteen/inc/js/GOV
  • https://forstcontrol.ch/info/wp-content/themes/twentynineteen/inc/js/GOV/
19 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://forstcontrol.ch/info/wp-content/themes/twentynineteen/inc/js/GOV/
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a01:ab20:0:203::15 , Switzerland, ASN47302 (CYON, CH),
Reverse DNS
Software
/
Resource Hash
183d21fe767d202e6d9979b86fa2d6d7b6349b0528d5c218602e41b1e06a47ac

Request headers

:method
GET
:authority
forstcontrol.ch
:scheme
https
:path
/info/wp-content/themes/twentynineteen/inc/js/GOV/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-type
text/html; charset=UTF-8
content-length
5500
content-encoding
br
vary
Accept-Encoding
date
Sun, 31 Jan 2021 11:40:18 GMT

Redirect headers

content-type
text/html
content-length
706
date
Sun, 31 Jan 2021 11:40:18 GMT
location
https://forstcontrol.ch/info/wp-content/themes/twentynineteen/inc/js/GOV/
alt-svc
quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000
govuk-template.css
www.tax.service.gov.uk/template/assets/stylesheets/ 		20 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.tax.service.gov.uk/template/assets/stylesheets/govuk-template.css
Requested by
Host: forstcontrol.ch
URL: https://forstcontrol.ch/info/wp-content/themes/twentynineteen/inc/js/GOV/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.90.232 , Netherlands, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a104-109-90-232.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
b56c2a21817362aeb9546f6a99f114c1df75afcce86762413b285a94c128e6dd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://forstcontrol.ch/info/wp-content/themes/twentynineteen/inc/js/GOV/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000;
Content-Encoding
gzip
X-Content-Type-Options
nosniff
x-amz-request-id
29F4B57A1F10FC4D
Connection
keep-alive
Content-Length
4366
x-amz-id-2
5suhlYeZeeVfVu+7M/rR7zFC3gcgbY2GjaKia/QkD/VvRmwEHb47FfUOPNtFU30ZWAPsmixYkYw=
Last-Modified
Mon, 11 Jan 2021 13:39:02 GMT
X-Frame-Options
DENY
Date
Sun, 31 Jan 2021 11:40:18 GMT
Vary
Accept-Encoding
Content-Type
text/css
X-XSS-Protection
1; mode=block
Cache-Control
max-age=1100
ETag
"8b1874e022c4792c580fa0e7f9105c3c"
X-Robots-Tag
noindex, nofollow
Expires
Sun, 31 Jan 2021 11:58:38 GMT
fonts.css
www.tax.service.gov.uk/template/assets/stylesheets/ 		267 KB
196 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.tax.service.gov.uk/template/assets/stylesheets/fonts.css
Requested by
Host: forstcontrol.ch
URL: https://forstcontrol.ch/info/wp-content/themes/twentynineteen/inc/js/GOV/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.90.232 , Netherlands, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a104-109-90-232.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
6813a04aa7ebe09726eda5fdd9c4abf1c5f151335adf0ad90474a5fe316e87ed
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://forstcontrol.ch/info/wp-content/themes/twentynineteen/inc/js/GOV/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000;
Content-Encoding
gzip
X-Content-Type-Options
nosniff
x-amz-request-id
2374285660C52A5A
Connection
keep-alive
Content-Length
200197
x-amz-id-2
DRkHnmANEDFFUn607j2vO0e2N72+FdedAjNsnGmw/d0uV253vaR65c34R5t+CGGP/Pq3gksBs80=
Last-Modified
Mon, 11 Jan 2021 13:39:02 GMT
X-Frame-Options
DENY
Date
Sun, 31 Jan 2021 11:40:18 GMT
Vary
Accept-Encoding
Content-Type
text/css
X-XSS-Protection
1; mode=block
Cache-Control
max-age=1325
ETag
"acaaac228246dd0eb9d5c1d9046094f7"
X-Robots-Tag
noindex, nofollow
Expires
Sun, 31 Jan 2021 12:02:23 GMT
application.min.css
www.tax.service.gov.uk/assets/3.15.0/stylesheets/ 		317 KB
53 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.tax.service.gov.uk/assets/3.15.0/stylesheets/application.min.css
Requested by
Host: forstcontrol.ch
URL: https://forstcontrol.ch/info/wp-content/themes/twentynineteen/inc/js/GOV/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.90.232 , Netherlands, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a104-109-90-232.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
2170c27ce1cde926e75ddad66d6d7ae6b0f2afc14f5014ca3d5b5527a1cd8cb0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://forstcontrol.ch/info/wp-content/themes/twentynineteen/inc/js/GOV/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000;
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Fri, 30 Oct 2020 12:02:25 GMT
x-amz-request-id
BJ3ZFJ8J1QAS1HCW
ETag
"461f93eba2f80306b8d128f80541bf25"
X-Frame-Options
SAMEORIGIN
Content-Type
text/css
Date
Sun, 31 Jan 2021 11:40:18 GMT
Connection
keep-alive
X-Robots-Tag
noindex, nofollow
Vary
Accept-Encoding
Content-Length
53563
x-amz-id-2
xu+uqxJBRV0aI1cYHAGscmIaDyDOwjqOdsSD01xZAg0ek9onGY88THDCEOu2BIMPA2fy/cxSyzI=
gtm_dl.js
www.tax.service.gov.uk/assets/gtm/0.1.12/include/ 		261 B
766 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.tax.service.gov.uk/assets/gtm/0.1.12/include/gtm_dl.js
Requested by
Host: forstcontrol.ch
URL: https://forstcontrol.ch/info/wp-content/themes/twentynineteen/inc/js/GOV/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.90.232 , Netherlands, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a104-109-90-232.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
c23abe7bf8999eb70f4662493a7d1d904a89761c7d0ca0b85a3190f999c3064a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://forstcontrol.ch/info/wp-content/themes/twentynineteen/inc/js/GOV/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000;
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Tue, 20 Oct 2020 14:42:59 GMT
x-amz-request-id
378D776B30AB5E4D
ETag
"4a8962921cfea36a6f41a6dc9459ceea"
X-Frame-Options
DENY
x-amz-id-2
d9iwwYJL4RjBYhpQ9uCghSeLK3jiDzUbcmk321CZ4ksr7cmcmMVOr8KQSEux4VQzcn9Et7AKKHo=
Content-Type
application/javascript
Date
Sun, 31 Jan 2021 11:40:18 GMT
Connection
keep-alive
X-Robots-Tag
noindex, nofollow
Vary
Accept-Encoding
Content-Length
198
X-XSS-Protection
1; mode=block
gtm.js
www.tax.service.gov.uk/assets/gtm/0.1.12/transitional/ 		370 B
869 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.tax.service.gov.uk/assets/gtm/0.1.12/transitional/gtm.js
Requested by
Host: forstcontrol.ch
URL: https://forstcontrol.ch/info/wp-content/themes/twentynineteen/inc/js/GOV/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.90.232 , Netherlands, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a104-109-90-232.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e074d42cc0d1ff552bfbcb88d172ad192adde7b5d6df1a1744587d214a5f1b41
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://forstcontrol.ch/info/wp-content/themes/twentynineteen/inc/js/GOV/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000;
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Tue, 20 Oct 2020 14:42:59 GMT
x-amz-request-id
C675267431F8B641
ETag
"636009c1dce784175cd197b134513ce6"
X-Frame-Options
DENY
x-amz-id-2
RiiISA/yPFPLD2+X9Sjnr8tirZ7ZpXG79Ipmr/Mx+/RbRrIIgtVKvMGLHpVXYq8P3hyzFwoHG+w=
Content-Type
application/javascript
Date
Sun, 31 Jan 2021 11:40:18 GMT
Connection
keep-alive
X-Robots-Tag
noindex, nofollow
Vary
Accept-Encoding
Content-Length
301
X-XSS-Protection
1; mode=block
modernizr.js
www.tax.service.gov.uk/assets/3.15.0/javascripts/vendor/ 		9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.tax.service.gov.uk/assets/3.15.0/javascripts/vendor/modernizr.js
Requested by
Host: forstcontrol.ch
URL: https://forstcontrol.ch/info/wp-content/themes/twentynineteen/inc/js/GOV/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.90.232 , Netherlands, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a104-109-90-232.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
d7168702b1139efae2115ac72fc34747518d7f362a5eb1f231f73e99524824e8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://forstcontrol.ch/info/wp-content/themes/twentynineteen/inc/js/GOV/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000;
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Fri, 30 Oct 2020 12:02:25 GMT
x-amz-request-id
B0ED942A5C9ADFB1
ETag
"a295a971b9afa8d87016fb3b1d588fbe"
X-Frame-Options
SAMEORIGIN
Content-Type
application/javascript
Date
Sun, 31 Jan 2021 11:40:18 GMT
Connection
keep-alive
X-Robots-Tag
noindex, nofollow
Vary
Accept-Encoding
Content-Length
3977
x-amz-id-2
hdBlXYAASIUjA80zh38ELaPMp0O+7HmGLdHCBpkkvrTN1BHTypBe1vIT8/TK/oJ1EANXfAzddJI=
styles.css
www.tax.service.gov.uk/personal-details-validation/assets/stylesheets/ 		2 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.tax.service.gov.uk/personal-details-validation/assets/stylesheets/styles.css
Requested by
Host: forstcontrol.ch
URL: https://forstcontrol.ch/info/wp-content/themes/twentynineteen/inc/js/GOV/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.90.232 , Netherlands, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a104-109-90-232.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
224b31514ccd3de80d3441d98a87e0b280d13585fedd00fa96913796ccd42862
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' localhost:9032 localhost:8291 online.hmrc.gov.uk webchat-dev.tax.service.gov.uk *.analytics-egain.com https://www.googletagmanager.com https://www.google-analytics.com https://tagmanager.google.com https://fonts.googleapis.com https://ssl.gstatic.com https://www.gstatic.com https://fonts.gstatic.com https://fonts.googleapis.com *.optimizely.com optimizely.s3.amazonaws.com data:
Strict-Transport-Security max-age=31536000;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://forstcontrol.ch/info/wp-content/themes/twentynineteen/inc/js/GOV/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Security-Policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' localhost:9032 localhost:8291 online.hmrc.gov.uk webchat-dev.tax.service.gov.uk *.analytics-egain.com https://www.googletagmanager.com https://www.google-analytics.com https://tagmanager.google.com https://fonts.googleapis.com https://ssl.gstatic.com https://www.gstatic.com https://fonts.gstatic.com https://fonts.googleapis.com *.optimizely.com optimizely.s3.amazonaws.com data:
Content-Encoding
gzip
x-content-type-options
nosniff
x-permitted-cross-domain-policies
master-only
x-envoy-upstream-service-time
6
Connection
keep-alive
Vary
Accept-Encoding
Content-Length
620
x-xss-protection
1; mode=block
X-UA-Compatible
IE=Edge
referrer-policy
origin-when-cross-origin, strict-origin-when-cross-origin
Last-Modified
Fri, 15 Jan 2021 15:30:58 GMT
x-frame-options
SAMEORIGIN
ETag
"d336998117ad1ed49ca5da400f0f85ef4a89c449"
Strict-Transport-Security
max-age=31536000;
Content-Type
text/css; charset=UTF-8
Cache-Control
public, max-age=2207
Accept-Ranges
bytes
X-Robots-Tag
noindex, nofollow
Date
Sun, 31 Jan 2021 11:40:18 GMT
gov.uk_logotype_crown.png
www.tax.service.gov.uk/template/assets/images/ 		780 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tax.service.gov.uk/template/assets/images/gov.uk_logotype_crown.png
Requested by
Host: forstcontrol.ch
URL: https://forstcontrol.ch/info/wp-content/themes/twentynineteen/inc/js/GOV/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.90.232 , Netherlands, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a104-109-90-232.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
14b98db97bbd6cb1f33935d3e0d973fa68ca0c38fb5762b033423ceffe9e16f6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://forstcontrol.ch/info/wp-content/themes/twentynineteen/inc/js/GOV/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000;
X-Content-Type-Options
nosniff
Last-Modified
Mon, 11 Jan 2021 13:39:02 GMT
x-amz-request-id
B62856364819302D
ETag
"7a0ea44ffc50dac67b82f0f70639d2ff"
X-Frame-Options
DENY
x-amz-id-2
i4XIcYVJMddTvwJ9TpXuzO1R+3+alZroCxi8/RQIeAOZZR7ZkR7fAmHYR47vTYVtOZhYT3rQ5Ac=
Content-Type
image/png
Cache-Control
max-age=1427
Date
Sun, 31 Jan 2021 11:40:18 GMT
Connection
keep-alive
X-Robots-Tag
noindex, nofollow
Content-Length
780
X-XSS-Protection
1; mode=block
Expires
Sun, 31 Jan 2021 12:04:05 GMT
logo.png
forstcontrol.ch/info/wp-content/themes/twentynineteen/inc/js/GOV/ 		43 KB
43 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://forstcontrol.ch/info/wp-content/themes/twentynineteen/inc/js/GOV/logo.png
Requested by
Host: forstcontrol.ch
URL: https://forstcontrol.ch/info/wp-content/themes/twentynineteen/inc/js/GOV/
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a01:ab20:0:203::15 , Switzerland, ASN47302 (CYON, CH),
Reverse DNS
Software
/
Resource Hash
9d65184ba38bd42bff98a3d1071e37d49cfa7bcae4f3b397b68069d142565e47

Request headers

Referer
https://forstcontrol.ch/info/wp-content/themes/twentynineteen/inc/js/GOV/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 31 Jan 2021 11:40:18 GMT
last-modified
Sat, 30 Jan 2021 14:50:38 GMT
etag
"ad04-6015723e-6961cb3a5a3bd791;;;"
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
44292
expires
Sun, 07 Feb 2021 11:40:18 GMT
govuk-template-print.css
www.tax.service.gov.uk/template/assets/stylesheets/ 		1 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.tax.service.gov.uk/template/assets/stylesheets/govuk-template-print.css
Requested by
Host: forstcontrol.ch
URL: https://forstcontrol.ch/info/wp-content/themes/twentynineteen/inc/js/GOV/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.90.232 , Netherlands, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a104-109-90-232.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
5bb990686d6668df3f9d5208b10fa83d2f5d55820b442be13542a3dfbd3e361a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://forstcontrol.ch/info/wp-content/themes/twentynineteen/inc/js/GOV/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000;
Content-Encoding
gzip
X-Content-Type-Options
nosniff
x-amz-request-id
CFADFFE59E765E3A
Connection
keep-alive
Content-Length
675
x-amz-id-2
mV/NnGG92AD8PHbciRp4SCf87RsVUbjnGXgRDzE9kEb5O1qROgDt/yvwTpBpBCaOM9HHaAyw0K4=
Last-Modified
Mon, 11 Jan 2021 13:39:02 GMT
X-Frame-Options
DENY
Date
Sun, 31 Jan 2021 11:40:18 GMT
Vary
Accept-Encoding
Content-Type
text/css
X-XSS-Protection
1; mode=block
Cache-Control
max-age=3056
ETag
"6652f6207c256a26f0987cfd09c6be57"
X-Robots-Tag
noindex, nofollow
Expires
Sun, 31 Jan 2021 12:31:14 GMT
gtm.js
www.googletagmanager.com/ 		230 KB
59 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-TSFTCWZ
Requested by
Host: www.tax.service.gov.uk
URL: https://www.tax.service.gov.uk/assets/gtm/0.1.12/transitional/gtm.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
4b302a307316b2b637e1028eb0cb3497e2e5654296fb12d60d45607728addfeb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://forstcontrol.ch/info/wp-content/themes/twentynineteen/inc/js/GOV/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 31 Jan 2021 11:40:18 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
60513
x-xss-protection
0
last-modified
Sun, 31 Jan 2021 09:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sun, 31 Jan 2021 11:40:18 GMT
truncated
/ 		94 KB
94 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
048b93884a1b51d20f2a3140541d450cb6b82c6c2cf69128ea1d09fdd9699f30

Request headers

Origin
https://forstcontrol.ch
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
application/font-woff
truncated
/ 		71 KB
71 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
01c73d5dd84423dd2fc30aabd1de09a86b36b6de9e2e240d954c09cbb1d97aba

Request headers

Origin
https://forstcontrol.ch
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
application/font-woff
govuk-crest.png
www.tax.service.gov.uk/template/assets/stylesheets/images/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tax.service.gov.uk/template/assets/stylesheets/images/govuk-crest.png
Requested by
Host: www.tax.service.gov.uk
URL: https://www.tax.service.gov.uk/template/assets/stylesheets/govuk-template.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.90.232 , Netherlands, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a104-109-90-232.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
bb9e22aff7881b895c2ceb41d9340804451c474b883f09fe1b4026e76456f44b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.tax.service.gov.uk/template/assets/stylesheets/govuk-template.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000;
X-Content-Type-Options
nosniff
Last-Modified
Mon, 11 Jan 2021 13:39:02 GMT
x-amz-request-id
0T6QDQBS2Z6X6K2G
ETag
"bcd5768bd7721641ee71ba103bb38900"
X-Frame-Options
DENY
x-amz-id-2
vHt5pRAWG0SFfRImfegMCkm5PMzSjC/5Nk9YJY80w7GAwxj7H8nZItju9yj8bRMcMVGcuRqWO7E=
Content-Type
image/png
Cache-Control
max-age=2739
Date
Sun, 31 Jan 2021 11:40:18 GMT
Connection
keep-alive
X-Robots-Tag
noindex, nofollow
Content-Length
3584
X-XSS-Protection
1; mode=block
Expires
Sun, 31 Jan 2021 12:25:57 GMT
js
www.googletagmanager.com/gtag/ 		134 KB
52 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-C1D8RZDS82&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TSFTCWZ
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
3d850af986b56af90c3a75cc8827585e0a33bb3cbf4403f45bbeb4d447e0dd26
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://forstcontrol.ch/info/wp-content/themes/twentynineteen/inc/js/GOV/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 31 Jan 2021 11:40:18 GMT
content-encoding
br
server
Google Tag Manager
access-control-allow-headers
Cache-Control
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
52565
x-xss-protection
0
expires
Sun, 31 Jan 2021 11:40:18 GMT
analytics.js
www.google-analytics.com/ 		46 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TSFTCWZ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://forstcontrol.ch/info/wp-content/themes/twentynineteen/inc/js/GOV/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 23 Oct 2020 03:00:57 GMT
server
Golfe2
age
1574
date
Sun, 31 Jan 2021 11:14:04 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18817
expires
Sun, 31 Jan 2021 13:14:04 GMT
collect
www.google-analytics.com/j/ 		1 B
386 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j87&aip=1&a=1217838866&t=pageview&_s=1&dl=https%3A%2F%2Fforstcontrol.ch%2Finfo%2Fwp-content%2Fthemes%2Ftwentynineteen%2Finc%2Fjs%2FGOV%2F&dp=%2Finfo%2Fwp-content%2Fthemes%2Ftwentynineteen%2Finc%2Fjs%2FGOV%2F&ul=en-us&de=UTF-8&dt=Enter%20your%20details%20-%20Confirm%20your%20identity%20-%20GOV.UK&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAAC~&jid=1197727178&gjid=1044593763&cid=622934964.1612093218&tid=UA-43414424-41&_gid=1688813060.1612093218&_r=1&gtm=2wg1k0TSFTCWZ&cd1=GTM-TSFTCWZ_166&cd6=Lunch&cd7=Sun%2C%2031%20Jan%202021%2011%3A40%3A18%20GMT&cd9=&cd10=false&cd11=&z=1389620442
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://forstcontrol.ch/info/wp-content/themes/twentynineteen/inc/js/GOV/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sun, 31 Jan 2021 11:40:18 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://forstcontrol.ch
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/g/ 		0
23 B 		Other
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/g/collect?v=2&tid=G-C1D8RZDS82&gtm=2oe1k0&_p=1217838866&sr=1600x1200&ul=en-us&cid=622934964.1612093218&_s=1&dl=https%3A%2F%2Fforstcontrol.ch%2Finfo%2Fwp-content%2Fthemes%2Ftwentynineteen%2Finc%2Fjs%2FGOV%2F&dr=&dt=Enter%20your%20details%20-%20Confirm%20your%20identity%20-%20GOV.UK&sid=1612093218&sct=1&seg=0&en=page_view&_fv=1&_ss=1&ep.page=%2Finfo%2Fwp-content%2Fthemes%2Ftwentynineteen%2Finc%2Fjs%2FGOV%2F
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-C1D8RZDS82&l=dataLayer&cx=c
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://forstcontrol.ch/info/wp-content/themes/twentynineteen/inc/js/GOV/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Sun, 31 Jan 2021 11:40:18 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://forstcontrol.ch
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: UK Government (Government)

29 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| dataLayer object| html5 object| Modernizr function| space object| el string| reportProblemAjaxUrl object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga string| DATALAYER_OBJECT_NAME function| referrerOverride function| sendCampaignData function| initNewOptimizelyIntegration function| initOptimizelyIntegration object| optimizely object| gaplugins object| gaGlobal object| gaData function| onYouTubeIframeAPIReady

4 Cookies

Domain/Path Name / Value
.forstcontrol.ch/ Name: _ga_C1D8RZDS82
Value: GS1.1.1612093218.1.0.1612093218.0
.forstcontrol.ch/ Name: _ga
Value: GA1.1.622934964.1612093218
.forstcontrol.ch/ Name: _gat_UA-43414424-41
Value: 1
.forstcontrol.ch/ Name: _gid
Value: GA1.2.1688813060.1612093218

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

forstcontrol.ch
www.google-analytics.com
www.googletagmanager.com
www.tax.service.gov.uk
104.109.90.232
2a00:1450:4001:808::2008
2a00:1450:4001:811::2008
2a00:1450:4001:811::200e
2a00:1450:4001:812::200e
2a01:ab20:0:203::15
01c73d5dd84423dd2fc30aabd1de09a86b36b6de9e2e240d954c09cbb1d97aba
048b93884a1b51d20f2a3140541d450cb6b82c6c2cf69128ea1d09fdd9699f30
14b98db97bbd6cb1f33935d3e0d973fa68ca0c38fb5762b033423ceffe9e16f6
183d21fe767d202e6d9979b86fa2d6d7b6349b0528d5c218602e41b1e06a47ac
2170c27ce1cde926e75ddad66d6d7ae6b0f2afc14f5014ca3d5b5527a1cd8cb0
224b31514ccd3de80d3441d98a87e0b280d13585fedd00fa96913796ccd42862
3d850af986b56af90c3a75cc8827585e0a33bb3cbf4403f45bbeb4d447e0dd26
4b302a307316b2b637e1028eb0cb3497e2e5654296fb12d60d45607728addfeb
5bb990686d6668df3f9d5208b10fa83d2f5d55820b442be13542a3dfbd3e361a
6813a04aa7ebe09726eda5fdd9c4abf1c5f151335adf0ad90474a5fe316e87ed
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
9d65184ba38bd42bff98a3d1071e37d49cfa7bcae4f3b397b68069d142565e47
b56c2a21817362aeb9546f6a99f114c1df75afcce86762413b285a94c128e6dd
bb9e22aff7881b895c2ceb41d9340804451c474b883f09fe1b4026e76456f44b
c23abe7bf8999eb70f4662493a7d1d904a89761c7d0ca0b85a3190f999c3064a
d7168702b1139efae2115ac72fc34747518d7f362a5eb1f231f73e99524824e8
e074d42cc0d1ff552bfbcb88d172ad192adde7b5d6df1a1744587d214a5f1b41
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b