www.cccktps.edu.hk
Open in
urlscan Pro
43.255.154.39
Malicious Activity!
Public Scan
Effective URL: https://www.cccktps.edu.hk/css/uk/uk/online/login.php?view=login&appIdKey=267f8e84d2a18fa&country=uk
Submission: On October 11 via manual from GB — Scanned from GB
Summary
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on October 10th 2022. Valid for: a year.
This is the only time www.cccktps.edu.hk was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: NatWest (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 2 | 195.78.66.221 195.78.66.221 | 41079 (CF-GDA) (CF-GDA) | |
1 19 | 43.255.154.39 43.255.154.39 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC) | |
2 | 2606:4700::68... 2606:4700::6811:180e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700::68... 2606:4700::6812:bcf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
21 | 3 |
ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: 39.154.255.43.host.secureserver.net
www.cccktps.edu.hk |
Apex Domain Subdomains |
Transfer | |
---|---|---|
19 |
cccktps.edu.hk
1 redirects
www.cccktps.edu.hk |
120 KB |
2 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 358 |
35 KB |
2 |
vot.pl
2 redirects
neilo32.vot.pl |
608 B |
1 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1229 |
14 KB |
21 | 4 |
Domain | Requested by | |
---|---|---|
19 | www.cccktps.edu.hk |
1 redirects
www.cccktps.edu.hk
|
2 | cdnjs.cloudflare.com |
www.cccktps.edu.hk
|
2 | neilo32.vot.pl | 2 redirects |
1 | maxcdn.bootstrapcdn.com |
www.cccktps.edu.hk
|
21 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
cccktps.edu.hk Go Daddy Secure Certificate Authority - G2 |
2022-10-10 - 2023-09-20 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-08-03 - 2023-08-02 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.cccktps.edu.hk/css/uk/uk/online/login.php?view=login&appIdKey=267f8e84d2a18fa&country=uk
Frame ID: 2E211CF34CB1E1B5345BA1A18BD0E59E
Requests: 21 HTTP requests in this frame
Screenshot
Page Title
Log in to NatWest Online BankingPage URL History Show full URLs
-
http://neilo32.vot.pl/c?b143674eac482125d4054963e1452e84
HTTP 301
http://neilo32.vot.pl/c/?b143674eac482125d4054963e1452e84 HTTP 302
https://www.cccktps.edu.hk/css/uk/?f5c83e7b Page URL
-
https://www.cccktps.edu.hk/css/uk/uk/index.php?pwd=natwest
HTTP 302
https://www.cccktps.edu.hk/css/uk/uk/online/login.php?view=login&appIdKey=267f8e84d2a18fa&country=uk Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Bootstrap (Web Frameworks) Expand
Detected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://neilo32.vot.pl/c?b143674eac482125d4054963e1452e84
HTTP 301
http://neilo32.vot.pl/c/?b143674eac482125d4054963e1452e84 HTTP 302
https://www.cccktps.edu.hk/css/uk/?f5c83e7b Page URL
-
https://www.cccktps.edu.hk/css/uk/uk/index.php?pwd=natwest
HTTP 302
https://www.cccktps.edu.hk/css/uk/uk/online/login.php?view=login&appIdKey=267f8e84d2a18fa&country=uk Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://neilo32.vot.pl/c?b143674eac482125d4054963e1452e84 HTTP 301
- http://neilo32.vot.pl/c/?b143674eac482125d4054963e1452e84 HTTP 302
- https://www.cccktps.edu.hk/css/uk/?f5c83e7b
21 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
www.cccktps.edu.hk/css/uk/ Redirect Chain
|
122 B 310 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
login.php
www.cccktps.edu.hk/css/uk/uk/online/ Redirect Chain
|
15 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
master.css
www.cccktps.edu.hk/css/uk/uk/online/css/ |
289 KB 50 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
npc.css
www.cccktps.edu.hk/css/uk/uk/online/css/ |
52 KB 10 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
overlayPromptMaster.css
www.cccktps.edu.hk/css/uk/uk/online/css/ |
1 KB 547 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
overlayPrompt.css
www.cccktps.edu.hk/css/uk/uk/online/css/ |
76 B 183 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
n-w-logo.svg
www.cccktps.edu.hk/css/uk/uk/online/css/ |
5 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
FSCS_Protected_Logo.png
www.cccktps.edu.hk/css/uk/uk/online/css/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/1.6.1/ |
89 KB 28 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.validate.min.js
cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.16.0/ |
23 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/ |
48 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
white-lock.png
www.cccktps.edu.hk/css/uk/uk/online/images/ |
285 B 361 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
down_chevron_purple_transparent.gif
www.cccktps.edu.hk/css/uk/uk/online/images/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
radio-selected.png
www.cccktps.edu.hk/css/uk/uk/online/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
combined-shape.png
www.cccktps.edu.hk/css/uk/uk/online/images/ |
359 B 435 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
RNHouseSansW05-Regular.woff2
www.cccktps.edu.hk/css/uk/uk/online/css/fonts/ |
21 KB 21 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
li5_outer_frame_top_curve.gif
www.cccktps.edu.hk/css/uk/uk/online/images/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
RNHouseSansW05-Bold.woff2
www.cccktps.edu.hk/css/uk/uk/online/css/fonts/ |
22 KB 22 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
radio-normal.png
www.cccktps.edu.hk/css/uk/uk/online/images/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
check-box.png
www.cccktps.edu.hk/css/uk/uk/online/images/ |
157 B 233 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
down-chevron.png
www.cccktps.edu.hk/css/uk/uk/online/images/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: NatWest (Banking)9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.cccktps.edu.hk/ | Name: PHPSESSID Value: 0eb70e13f93eb3d4e7fdfcf75a144603 |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
maxcdn.bootstrapcdn.com
neilo32.vot.pl
www.cccktps.edu.hk
195.78.66.221
2606:4700::6811:180e
2606:4700::6812:bcf
43.255.154.39
1ec277d20cb0b2b9d72322f3cc32d988435978a6a8f72b28e0f8ac8b1bf17a72
42e70c32efffee33a1d8bddf152d6b754fa8abb83c6166444b8d41b217d9dae6
4e04ac194496352db327eea09a38329fce29af010b0d9ed4c0205c727e97ce02
50e497b00818378dcffe856b994f89947b620c66163768879c9b8a63d583f898
668faa210a0e0cabb9aa13a1a6ad4e3b22b0f9cad90c43694ba37a8a4714b0e6
97031846c8a86f0cc2152c7cbcce3c6087cb00a20639f11e21870bf2615cb726
9be8b2c42ad2d6f7327f62a7d03995a5a4615770154941d59493473186e5140c
b465d00b89619e9899ec7d618559157db09f935d318466d67deb036157fadcf2
bb0cdce0c3ed99c30abac06399a7a340c87cb82920154ac3b06e7aa05f7386cb
c784376960f3163dc760bc019e72e5fed78203745a5510c69992a39d1d8fe776
ce64c0d35d4ad8fd2fa79ecd45d6db37982940958b7f51448b697bad342ce55b
d1c878b4e69d9da5292c53b1f46708de74c435144895bdfd697208406466a814
d2955b58d801a021737f025d1716a68fd2a143ddac3e0b749fcc053deba6e082
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
d81db57832f4742b67755f90f8c3d37735cb9f58dbb10e312f931343d27552c6
dfa649bf3af17f90799326b97e046884e78ab80fa6a2598a2fa5941e5ccce6d9
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
ef7db794b4a6b5c42d2535919d91fb11da1e5cd1147f35196db382197b35fdee
f2b557317fb851b3ed73c2d8203192e9ed433bd006ca5025ccb3317ef15e1b8d