sjs-legal.co.uk - urlscan.io

Summary

This website contacted 1 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main IP is 91.238.161.115, located in United Kingdom and belongs to PULSANT-AS, GB. The main domain is sjs-legal.co.uk.
TLS certificate: Issued by cPanel, Inc. Certification Authority on November 16th 2019. Valid for: 3 months.

This is the only time sjs-legal.co.uk was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial)

Domain & IP information

	IP Address	AS Autonomous System
2 2	206.123.152.19 206.123.152.19	35017 (SWIFTWAY-...) (SWIFTWAY-AS Netherlands)
1 6	91.238.161.115 91.238.161.115	12703 (PULSANT-AS) (PULSANT-AS)
5	1

2 206.123.152.19 (Almaty, Kazakhstan) 2 redirects

ASN35017 (SWIFTWAY-AS Netherlands, GB)

irakopl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 91.238.161.115 (United Kingdom) 1 redirects

ASN12703 (PULSANT-AS, GB)
PTR: hh-law.enixvps.com

sjs-legal.co.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	sjs-legal.co.uk 1 redirects sjs-legal.co.uk	48 KB
2	irakopl.com 2 redirects irakopl.com	480 B
5	2

	Domain	Requested by
6	sjs-legal.co.uk	1 redirects sjs-legal.co.uk
2	irakopl.com	2 redirects
5	2

This site contains no links.

Subject Issuer	Validity	Valid
sjs-legal.co.uk cPanel, Inc. Certification Authority	`2019-11-16` - `2020-02-14`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://sjs-legal.co.uk/.a/lgin.php?&referal=acton_REQ&ee=windows_1252&jession=SwWiwZnhHovanlPQiis
Frame ID: 43CB40096BA065D7C98FA12EFE2DE83A
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://irakopl.com/.b HTTP 301
https://irakopl.com/.b/ HTTP 302
https://sjs-legal.co.uk/.a HTTP 301
https://sjs-legal.co.uk/.a/ Page URL
https://sjs-legal.co.uk/.a/lgin.php?&referal=acton_REQ&ee=windows_1252&jession=SwWiwZnhHovanlPQiis Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

5
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

48 kB
Transfer

128 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://irakopl.com/.b HTTP 301
https://irakopl.com/.b/ HTTP 302
https://sjs-legal.co.uk/.a HTTP 301
https://sjs-legal.co.uk/.a/ Page URL
https://sjs-legal.co.uk/.a/lgin.php?&referal=acton_REQ&ee=windows_1252&jession=SwWiwZnhHovanlPQiis Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://irakopl.com/.b HTTP 301
https://irakopl.com/.b/ HTTP 302
https://sjs-legal.co.uk/.a HTTP 301
https://sjs-legal.co.uk/.a/

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

/ Show response
sjs-legal.co.uk/.a/
Redirect Chain

https://irakopl.com/.b
https://irakopl.com/.b/
https://sjs-legal.co.uk/.a
https://sjs-legal.co.uk/.a/

117 B
321 B

76ms
75ms

Document
text/html

91.238.161.115
PULSANT-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://sjs-legal.co.uk/.a/

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.238.161.115 , United Kingdom, ASN12703 (PULSANT-AS, GB),

Reverse DNS

hh-law.enixvps.com

Software

Apache /

Resource Hash

70649a42d86339e1abf724e73845dc08a519a7f8cf1dca4b455845c01a7d7a03

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:method: GET
:authority: sjs-legal.co.uk
:scheme: https
:path: /.a/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-user: ?1
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: none
sec-fetch-mode: navigate
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-User: ?1

Response headers

status: 200
date: Wed, 04 Dec 2019 11:41:48 GMT
server: Apache
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
set-cookie: PHPSESSID=eqji8ip5uj24migkjk46odt396; path=/
strict-transport-security: max-age=31536000
vary: Accept-Encoding
content-encoding: gzip
content-length: 133
content-type: text/html; charset=UTF-8

Redirect headers

status: 301
date: Wed, 04 Dec 2019 11:41:48 GMT
server: Apache
strict-transport-security: max-age=31536000
location: https://sjs-legal.co.uk/.a/
cache-control: max-age=0
expires: Wed, 04 Dec 2019 11:41:48 GMT
content-length: 301
content-type: text/html; charset=iso-8859-1

GET
H2 200 Primary Request lgin.php Show response
sjs-legal.co.uk/.a/ 15 KB
4 KB 72ms
72ms Document
text/html 91.238.161.115
PULSANT-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://sjs-legal.co.uk/.a/lgin.php?&referal=acton_REQ&ee=windows_1252&jession=SwWiwZnhHovanlPQiis

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.238.161.115 , United Kingdom, ASN12703 (PULSANT-AS, GB),

Reverse DNS

hh-law.enixvps.com

Software

Apache /

Resource Hash

1c4a663b60eac49af14e27f44d89b40ab6f48e436f1b1a4459d08d3ba580d3db

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:method: GET
:authority: sjs-legal.co.uk
:scheme: https
:path: /.a/lgin.php?&referal=acton_REQ&ee=windows_1252&jession=SwWiwZnhHovanlPQiis
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: same-origin
sec-fetch-mode: navigate
referer: https://sjs-legal.co.uk/.a/
accept-encoding: gzip, deflate, br
cookie: PHPSESSID=eqji8ip5uj24migkjk46odt396
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://sjs-legal.co.uk/.a/

Response headers

status: 200
date: Wed, 04 Dec 2019 11:41:48 GMT
server: Apache
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
content-encoding: gzip
content-length: 4036
content-type: text/html; charset=UTF-8

GET
H2 200 forms.css
sjs-legal.co.uk/.a/src/css/ 80 KB
14 KB 42ms
42ms Stylesheet
text/css 91.238.161.115
PULSANT-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://sjs-legal.co.uk/.a/src/css/forms.css?callerI=jcbziKeqpzfyRqsOGqlGeCqVSSF

Requested by

Host: sjs-legal.co.uk
URL: https://sjs-legal.co.uk/.a/lgin.php?&referal=acton_REQ&ee=windows_1252&jession=SwWiwZnhHovanlPQiis

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.238.161.115 , United Kingdom, ASN12703 (PULSANT-AS, GB),

Reverse DNS

hh-law.enixvps.com

Software

Apache /

Resource Hash

59f1eaef58e12caecb749a7db5bc29cf27c706e658e2fcbf905b1c530c83e08c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://sjs-legal.co.uk/.a/lgin.php?&referal=acton_REQ&ee=windows_1252&jession=SwWiwZnhHovanlPQiis
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 04 Dec 2019 11:41:48 GMT
content-encoding: gzip
last-modified: Mon, 13 May 2019 04:10:06 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css; charset=utf-8
status: 200
cache-control: max-age=31536000, public
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 14098
expires: Thu, 03 Dec 2020 11:41:48 GMT

GET
H2 404 signin.htm
sjs-legal.co.uk/.a/src/css/ 28 KB
28 KB 961ms
961ms Image
text/html 91.238.161.115
PULSANT-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sjs-legal.co.uk/.a/src/css/signin.htm

Requested by

Host: sjs-legal.co.uk
URL: https://sjs-legal.co.uk/.a/lgin.php?&referal=acton_REQ&ee=windows_1252&jession=SwWiwZnhHovanlPQiis

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.238.161.115 , United Kingdom, ASN12703 (PULSANT-AS, GB),

Reverse DNS

hh-law.enixvps.com

Software

Apache /

Resource Hash

80100b47d6b8fd2226c94d37251eb6a73e8cf95602237f4ab31cea66a1bc83fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://sjs-legal.co.uk/.a/lgin.php?&referal=acton_REQ&ee=windows_1252&jession=SwWiwZnhHovanlPQiis
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 04 Dec 2019 11:41:48 GMT
content-encoding: gzip
server: Apache
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
status: 404
cache-control: no-cache, must-revalidate, max-age=0
strict-transport-security: max-age=31536000
link: <https://sjs-legal.co.uk/wp-json/>; rel="https://api.w.org/"
content-length: 6919
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 200 paypal-logo-129x32.svg
sjs-legal.co.uk/.a/src/css/ 5 KB
2 KB 63ms
62ms Image
image/svg+xml 91.238.161.115
PULSANT-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sjs-legal.co.uk/.a/src/css/paypal-logo-129x32.svg

Requested by

Host: sjs-legal.co.uk
URL: https://sjs-legal.co.uk/.a/lgin.php?&referal=acton_REQ&ee=windows_1252&jession=SwWiwZnhHovanlPQiis

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.238.161.115 , United Kingdom, ASN12703 (PULSANT-AS, GB),

Reverse DNS

hh-law.enixvps.com

Software

Apache /

Resource Hash

b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://sjs-legal.co.uk/.a/src/css/forms.css?callerI=jcbziKeqpzfyRqsOGqlGeCqVSSF
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 04 Dec 2019 11:41:48 GMT
content-encoding: gzip
last-modified: Mon, 13 May 2019 04:06:54 GMT
server: Apache
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
cache-control: max-age=2592000, public
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 1929
expires: Fri, 03 Jan 2020 11:41:48 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			sjs-legal.co.uk/	1969-12-31 23:59:59	Name: PHPSESSID Value: eqji8ip5uj24migkjk46odt396

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

irakopl.com
sjs-legal.co.uk
206.123.152.19
91.238.161.115
1c4a663b60eac49af14e27f44d89b40ab6f48e436f1b1a4459d08d3ba580d3db
59f1eaef58e12caecb749a7db5bc29cf27c706e658e2fcbf905b1c530c83e08c
70649a42d86339e1abf724e73845dc08a519a7f8cf1dca4b455845c01a7d7a03
80100b47d6b8fd2226c94d37251eb6a73e8cf95602237f4ab31cea66a1bc83fb
b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5

sjs-legal.co.uk Open in urlscan Pro 91.238.161.115 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

5 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

1 IPs

2 Countries

48 kBTransfer

128 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

1 Cookies

Security Headers

Indicators

sjs-legal.co.uk Open in urlscan Pro
91.238.161.115 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

48 kB
Transfer

128 kB
Size

1
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!