pandp64.co.uk Open in urlscan Pro
213.5.71.103  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://www.joytogroup.com/wp-content/ Page URL
2. https://picestudios.com/wp-content/upgrade/boaredhsb/ Page URL
3. https://pandp64.co.uk/wp-content/upgrade/boaredhsb/ Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response www.joytogroup.com/wp-content/	119 B 227 B	71ms 20ms	Document text/html	80.247.175.21 DENIT-AS Amsterdam
General Check archive.org Show headers Download Go to Full URL https://www.joytogroup.com/wp-content/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 80.247.175.21 , Netherlands, ASN25542 (DENIT-AS Amsterdam, NL), Reverse DNS web12.movenext.nl Software nginx / PHP/7.3.25 PleskLin Resource Hash 40da96affd2e33d1ed551dcc376c09737126a0439ec7cc8d07a9275b74641276 Request headers :method GET :authority www.joytogroup.com :scheme https :path /wp-content/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers server nginx date Tue, 08 Dec 2020 17:31:25 GMT content-type text/html; charset=UTF-8 x-powered-by PHP/7.3.25 PleskLin
GET H/1.1	200 OK	/ Show response picestudios.com/wp-content/upgrade/boaredhsb/	117 B 402 B	319ms 61ms	Document text/html	212.34.145.211 AXARNET-AS
General Check archive.org Show headers Download Go to Full URL https://picestudios.com/wp-content/upgrade/boaredhsb/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 212.34.145.211 , Spain, ASN50926 (AXARNET-AS, ES), Reverse DNS Software Apache/2 / PHP/7.4.13 Resource Hash dff0c27bdad608038fbe31ab75fe341d9fe4fdf612b0b887a8324f09d7e345e3 Request headers Host picestudios.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest document Referer https://www.joytogroup.com/wp-content/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.joytogroup.com/wp-content/ Response headers Date Tue, 08 Dec 2020 17:31:26 GMT Server Apache/2 X-Powered-By PHP/7.4.13 Vary Accept-Encoding,User-Agent Content-Encoding gzip Content-Length 127 Keep-Alive timeout=2, max=100 Connection Keep-Alive Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	Primary Request Cookie set / Show response pandp64.co.uk/wp-content/upgrade/boaredhsb/	389 B 742 B	269ms 135ms	Document text/html	213.5.71.103 ALTUS
General Check archive.org Show headers Download Go to Full URL https://pandp64.co.uk/wp-content/upgrade/boaredhsb/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 213.5.71.103 , Netherlands, ASN51430 (ALTUS, NL), Reverse DNS server.ukserver360.com Software Apache / Resource Hash ea771cbf42a69918c0f50d76bf7b318ea505715f81dcd60e6b264967ea488793 Request headers Host pandp64.co.uk Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest document Referer https://picestudios.com/wp-content/upgrade/boaredhsb/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://picestudios.com/wp-content/upgrade/boaredhsb/ Response headers Date Tue, 08 Dec 2020 17:31:26 GMT Server Apache Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Set-Cookie cazanova=5e2113d66579c10cd3bb35010f989543a318fb48; expires=Tue, 08-Dec-2020 19:31:26 GMT; Max-Age=7200; path=/; HttpOnly Vary Accept-Encoding Content-Encoding gzip Content-Length 262 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	captcha.js Show response pandp64.co.uk/wp-content/upgrade/boaredhsb/assets/js/	118 KB 42 KB	38ms 38ms	Script application/javascript	213.5.71.103 ALTUS
General Check archive.org Show headers Download Go to Full URL https://pandp64.co.uk/wp-content/upgrade/boaredhsb/assets/js/captcha.js Requested by Host: pandp64.co.uk URL: https://pandp64.co.uk/wp-content/upgrade/boaredhsb/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 213.5.71.103 , Netherlands, ASN51430 (ALTUS, NL), Reverse DNS server.ukserver360.com Software Apache / Resource Hash 7b0159b18a5fbaea723b6b95de2f895aee4e41db740e241599c86bbb6f6f1988 Request headers Referer https://pandp64.co.uk/wp-content/upgrade/boaredhsb/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 08 Dec 2020 17:31:26 GMT Content-Encoding gzip Last-Modified Tue, 01 Dec 2020 02:23:36 GMT Server Apache Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 43160
GET H/1.1	200 OK	captcha.png pandp64.co.uk/wp-content/upgrade/boaredhsb/	17 KB 18 KB	106ms 106ms	Image image/png	213.5.71.103 ALTUS
General Check archive.org Show headers Download Go to Show image Full URL https://pandp64.co.uk/wp-content/upgrade/boaredhsb/captcha.png?_1607448688539 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 213.5.71.103 , Netherlands, ASN51430 (ALTUS, NL), Reverse DNS server.ukserver360.com Software Apache / Resource Hash cfb0c4c68347876174df7f33afff98a8c4b231d0164c671999e307bd11355b66 Request headers Referer https://pandp64.co.uk/wp-content/upgrade/boaredhsb/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Pragma no-cache Date Tue, 08 Dec 2020 17:31:28 GMT Content-Encoding gzip Server Apache Vary Accept-Encoding Content-Type image/png Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Keep-Alive timeout=5, max=98 Content-Length 17781 Expires Thu, 19 Nov 1981 08:52:00 GMT
GET H/1.1	200 OK	logo-129x32.svg pandp64.co.uk/wp-content/upgrade/boaredhsb/assets/main/images/	5 KB 2 KB	77ms 39ms	Image image/svg+xml	213.5.71.103 ALTUS
General Check archive.org Show headers Download Go to Show image Full URL https://pandp64.co.uk/wp-content/upgrade/boaredhsb/assets/main/images/logo-129x32.svg Requested by Host: pandp64.co.uk URL: https://pandp64.co.uk/wp-content/upgrade/boaredhsb/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 213.5.71.103 , Netherlands, ASN51430 (ALTUS, NL), Reverse DNS server.ukserver360.com Software Apache / Resource Hash 507ea8a27c8892c5461063d3a2c1534c5c847c48577f60d3a0ffb441c3c518ca Request headers Referer https://pandp64.co.uk/wp-content/upgrade/boaredhsb/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 08 Dec 2020 17:31:28 GMT Content-Encoding gzip Last-Modified Tue, 01 Dec 2020 02:23:36 GMT Server Apache Vary Accept-Encoding Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 2228

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Bank of America (Banking)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| setImmediate function| clearImmediate function| Vue

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			pandp64.co.uk/	1970-01-19 14:30:55	Name: cazanova Value: 5e2113d66579c10cd3bb35010f989543a318fb48

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

pandp64.co.uk
picestudios.com
www.joytogroup.com
212.34.145.211
213.5.71.103
80.247.175.21
40da96affd2e33d1ed551dcc376c09737126a0439ec7cc8d07a9275b74641276
507ea8a27c8892c5461063d3a2c1534c5c847c48577f60d3a0ffb441c3c518ca
7b0159b18a5fbaea723b6b95de2f895aee4e41db740e241599c86bbb6f6f1988
cfb0c4c68347876174df7f33afff98a8c4b231d0164c671999e307bd11355b66
dff0c27bdad608038fbe31ab75fe341d9fe4fdf612b0b887a8324f09d7e345e3
ea771cbf42a69918c0f50d76bf7b318ea505715f81dcd60e6b264967ea488793