covidapply-pass.digital
Open in
urlscan Pro
141.136.39.11
Malicious Activity!
Public Scan
Effective URL: http://covidapply-pass.digital/step1.php?XKhaSRAHj&inID=zzxNwgMNmjpLEdEYzLKBvWKDdtdbqzlhpwiEbgKZe
Submission Tags: https://phish.report @phish_report Search All
Submission: On October 26 via api from FI — Scanned from DE
Summary
This is the only time covidapply-pass.digital was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: NHS UK (Healthcare)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 5 | 141.136.39.11 141.136.39.11 | 47583 (AS-HOSTINGER) (AS-HOSTINGER) | |
1 | 69.16.175.42 69.16.175.42 | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
2 | 88.221.60.244 88.221.60.244 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
7 | 3 |
ASN47583 (AS-HOSTINGER, CY)
PTR: cpl13.main-hosting.eu
covidapply-pass.digital |
ASN20446 (HIGHWINDS3, US)
PTR: tlb.hwcdn.net
code.jquery.com |
ASN16625 (AKAMAI-AS, US)
PTR: a88-221-60-244.deploy.static.akamaitechnologies.com
assets.nhs.uk |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
covidapply-pass.digital
1 redirects
covidapply-pass.digital |
19 KB |
2 |
assets.nhs.uk
assets.nhs.uk |
35 KB |
1 |
jquery.com
code.jquery.com |
30 KB |
7 | 3 |
Domain | Requested by | |
---|---|---|
5 | covidapply-pass.digital |
1 redirects
covidapply-pass.digital
|
2 | assets.nhs.uk |
covidapply-pass.digital
|
1 | code.jquery.com |
covidapply-pass.digital
|
7 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2021-07-14 - 2022-08-14 |
a year | crt.sh |
www.nhs.uk DigiCert SHA2 Secure Server CA |
2021-07-16 - 2022-08-07 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://covidapply-pass.digital/step1.php?XKhaSRAHj&inID=zzxNwgMNmjpLEdEYzLKBvWKDdtdbqzlhpwiEbgKZe
Frame ID: 14BEDF1216684F3E63DE594C41189774
Requests: 7 HTTP requests in this frame
Screenshot
Page Title
What is your name? - Book a coronavirus vaccination - NHSPage URL History Show full URLs
-
http://covidapply-pass.digital/
HTTP 302
http://covidapply-pass.digital/step1.php?XKhaSRAHj&inID=zzxNwgMNmjpLEdEYzLKBvWKDdtdbqzlhpwiEbgKZe Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://covidapply-pass.digital/
HTTP 302
http://covidapply-pass.digital/step1.php?XKhaSRAHj&inID=zzxNwgMNmjpLEdEYzLKBvWKDdtdbqzlhpwiEbgKZe Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
step1.php
covidapply-pass.digital/ Redirect Chain
|
13 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.css
covidapply-pass.digital/css/ |
77 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.0.min.js
code.jquery.com/ |
87 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.redirect.js
covidapply-pass.digital/js/ |
6 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
functions.js
covidapply-pass.digital/js/ |
11 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
FrutigerLTW01-55Roman.woff2
assets.nhs.uk/fonts/ |
17 KB 17 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
FrutigerLTW01-65Bold.woff2
assets.nhs.uk/fonts/ |
17 KB 17 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: NHS UK (Healthcare)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect boolean| originAgentCluster function| $ function| jQuery function| valid_credit_card function| clear_field function| submit function| expiry_format1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
covidapply-pass.digital/ | Name: PHPSESSID Value: 5e1d8f14a5f13d63ce4191412106ffa5 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
assets.nhs.uk
code.jquery.com
covidapply-pass.digital
141.136.39.11
69.16.175.42
88.221.60.244
16df4867f34dfc9389823b16948a458d43970afcfc35f34a0622bfb543387d2a
6d69ae5c4892d35573385da52afebec92fb02feaf7670b0684c1b2aa6f2cfb98
886f640d4cb31c0114351f25e5eeba98b79e7ae405fcc2ca50aac6ed79ff8995
94867ddc9932620b774c5e56e63b445893403ba082b1ec344111ccf0085576d8
973ef58ab4a82d11e857b80ccaa4400e5630374b6ac0598932b75b3e0f844f1e
d7a61b8131c25f4f7949162fcf342c8ba52b0257756aaacf23aa948f0403c842
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e