hmm-revenue-customers.ew.r.appspot.com Open in urlscan Pro
2607:f8b0:4003:c0c::99  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
5 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response hmm-revenue-customers.ew.r.appspot.com/	183 KB 115 KB	551ms 296ms	Document text/html	2607:f8b0:4003:c0c::99 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://hmm-revenue-customers.ew.r.appspot.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4003:c0c::99 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Google Frontend / Resource Hash b6a3a582f919c05ea1f75862ce1b572b0a903932caca8a9d7c396813d2e663e7 Request headers :method GET :authority hmm-revenue-customers.ew.r.appspot.com :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 content-type text/html; charset=UTF-8 vary Accept-Encoding content-encoding gzip x-cloud-trace-context 9d9aa4bf33e2df4fc556f50d453e5e8f;o=1 date Tue, 20 Oct 2020 09:18:56 GMT server Google Frontend cache-control private content-length 117388 alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H2	200	jquery.min.js Show response cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/	85 KB 27 KB	19ms 19ms	Script application/javascript	2606:4700::6811:4f6b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js Requested by Host: hmm-revenue-customers.ew.r.appspot.com URL: https://hmm-revenue-customers.ew.r.appspot.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:4f6b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de Security Headers Name Value Strict-Transport-Security max-age=15780000; includeSubDomains Request headers Referer https://hmm-revenue-customers.ew.r.appspot.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 20 Oct 2020 09:18:57 GMT content-encoding br vary Accept-Encoding cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 1685610 x-via cfworker/kv status 200 alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 27277 cf-request-id 05e6e70852000097660a8f8000000001 timing-allow-origin * last-modified Mon, 04 May 2020 16:11:48 GMT server cloudflare etag "5eb03ec4-15283" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000; includeSubDomains report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603185537"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes cf-ray 5e51a786ea919766-FRA expires Sun, 10 Oct 2021 09:18:57 GMT
GET DATA	200 OK	truncated /	11 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 34b53621f50bda83302e248619666fcc73ec42c17b90b1b5066478c30dea257e Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	55 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash fa5cfa30d7806fd31339494fedb50a3dda7341a61a868bc7d62d5161d909ac1b Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 47f64f78db1e616f772ff22370549d440409c5725b5fc770a49119f8f6e60bc8 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	8 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 71e878fd5c30a631ab70daa6edeca477869cc13adf3841802daf70491824838c Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	37 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 00d54b962885d148c7c4c146110c17b1967fac317d43eb66e3d5cc9c2745309a Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: UK Government (Government)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes function| $ function| jQuery function| numbersOnly function| digitsOnly function| allowedChars function| isOneOf object| input

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
hmm-revenue-customers.ew.r.appspot.com
2606:4700::6811:4f6b
2607:f8b0:4003:c0c::99
00d54b962885d148c7c4c146110c17b1967fac317d43eb66e3d5cc9c2745309a
34b53621f50bda83302e248619666fcc73ec42c17b90b1b5066478c30dea257e
47f64f78db1e616f772ff22370549d440409c5725b5fc770a49119f8f6e60bc8
71e878fd5c30a631ab70daa6edeca477869cc13adf3841802daf70491824838c
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
b6a3a582f919c05ea1f75862ce1b572b0a903932caca8a9d7c396813d2e663e7
fa5cfa30d7806fd31339494fedb50a3dda7341a61a868bc7d62d5161d909ac1b