pandp64.co.uk Open in urlscan Pro
213.5.71.103  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://www.joytogroup.com/wp-content/ Page URL
2. https://picestudios.com/wp-content/upgrade/boaredhsb/ Page URL
3. https://pandp64.co.uk/wp-content/upgrade/boaredhsb/ Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response www.joytogroup.com/wp-content/	119 B 227 B	120ms 32ms	Document text/html	80.247.175.21 DENIT-AS Amsterdam
General Check archive.org Show headers Download Go to Full URL https://www.joytogroup.com/wp-content/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 80.247.175.21 , Netherlands, ASN25542 (DENIT-AS Amsterdam, NL), Reverse DNS web12.movenext.nl Software nginx / PHP/7.3.25 PleskLin Resource Hash 40da96affd2e33d1ed551dcc376c09737126a0439ec7cc8d07a9275b74641276 Request headers :method GET :authority www.joytogroup.com :scheme https :path /wp-content/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers server nginx date Wed, 09 Dec 2020 06:33:38 GMT content-type text/html; charset=UTF-8 x-powered-by PHP/7.3.25 PleskLin
GET H/1.1	200 OK	/ Show response picestudios.com/wp-content/upgrade/boaredhsb/	117 B 402 B	306ms 64ms	Document text/html	212.34.145.211 AXARNET-AS
General Check archive.org Show headers Download Go to Full URL https://picestudios.com/wp-content/upgrade/boaredhsb/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 212.34.145.211 , Spain, ASN50926 (AXARNET-AS, ES), Reverse DNS Software Apache/2 / PHP/7.4.13 Resource Hash dff0c27bdad608038fbe31ab75fe341d9fe4fdf612b0b887a8324f09d7e345e3 Request headers Host picestudios.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest document Referer https://www.joytogroup.com/wp-content/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.joytogroup.com/wp-content/ Response headers Date Wed, 09 Dec 2020 06:33:38 GMT Server Apache/2 X-Powered-By PHP/7.4.13 Vary Accept-Encoding,User-Agent Content-Encoding gzip Content-Length 127 Keep-Alive timeout=2, max=100 Connection Keep-Alive Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	Primary Request Cookie set / Show response pandp64.co.uk/wp-content/upgrade/boaredhsb/	389 B 742 B	250ms 158ms	Document text/html	213.5.71.103 ALTUS
General Check archive.org Show headers Download Go to Full URL https://pandp64.co.uk/wp-content/upgrade/boaredhsb/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 213.5.71.103 , Netherlands, ASN51430 (ALTUS, NL), Reverse DNS server.ukserver360.com Software Apache / Resource Hash ea771cbf42a69918c0f50d76bf7b318ea505715f81dcd60e6b264967ea488793 Request headers Host pandp64.co.uk Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest document Referer https://picestudios.com/wp-content/upgrade/boaredhsb/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://picestudios.com/wp-content/upgrade/boaredhsb/ Response headers Date Wed, 09 Dec 2020 06:33:38 GMT Server Apache Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Set-Cookie cazanova=6252cb22db8c55a76d438baf9ad61eb12a3d0958; expires=Wed, 09-Dec-2020 08:33:38 GMT; Max-Age=7200; path=/; HttpOnly Vary Accept-Encoding Content-Encoding gzip Content-Length 262 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	captcha.js Show response pandp64.co.uk/wp-content/upgrade/boaredhsb/assets/js/	118 KB 42 KB	66ms 66ms	Script application/javascript	213.5.71.103 ALTUS
General Check archive.org Show headers Download Go to Full URL https://pandp64.co.uk/wp-content/upgrade/boaredhsb/assets/js/captcha.js Requested by Host: pandp64.co.uk URL: https://pandp64.co.uk/wp-content/upgrade/boaredhsb/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 213.5.71.103 , Netherlands, ASN51430 (ALTUS, NL), Reverse DNS server.ukserver360.com Software Apache / Resource Hash 7b0159b18a5fbaea723b6b95de2f895aee4e41db740e241599c86bbb6f6f1988 Request headers Referer https://pandp64.co.uk/wp-content/upgrade/boaredhsb/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 09 Dec 2020 06:33:38 GMT Content-Encoding gzip Last-Modified Tue, 01 Dec 2020 02:23:36 GMT Server Apache Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 43160
GET H/1.1	200 OK	captcha.png pandp64.co.uk/wp-content/upgrade/boaredhsb/	17 KB 18 KB	98ms 97ms	Image image/png	213.5.71.103 ALTUS
General Check archive.org Show headers Download Go to Show image Full URL https://pandp64.co.uk/wp-content/upgrade/boaredhsb/captcha.png?_1607495620760 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 213.5.71.103 , Netherlands, ASN51430 (ALTUS, NL), Reverse DNS server.ukserver360.com Software Apache / Resource Hash eaebf773bdb28b798e72b6296512a5c4b947d7d7b9b8289dda9bd846b41352d1 Request headers Referer https://pandp64.co.uk/wp-content/upgrade/boaredhsb/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Pragma no-cache Date Wed, 09 Dec 2020 06:33:40 GMT Content-Encoding gzip Server Apache Vary Accept-Encoding Content-Type image/png Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Keep-Alive timeout=5, max=98 Content-Length 17796 Expires Thu, 19 Nov 1981 08:52:00 GMT
GET H/1.1	200 OK	logo-129x32.svg pandp64.co.uk/wp-content/upgrade/boaredhsb/assets/main/images/	5 KB 2 KB	114ms 45ms	Image image/svg+xml	213.5.71.103 ALTUS
General Check archive.org Show headers Download Go to Show image Full URL https://pandp64.co.uk/wp-content/upgrade/boaredhsb/assets/main/images/logo-129x32.svg Requested by Host: pandp64.co.uk URL: https://pandp64.co.uk/wp-content/upgrade/boaredhsb/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 213.5.71.103 , Netherlands, ASN51430 (ALTUS, NL), Reverse DNS server.ukserver360.com Software Apache / Resource Hash 507ea8a27c8892c5461063d3a2c1534c5c847c48577f60d3a0ffb441c3c518ca Request headers Referer https://pandp64.co.uk/wp-content/upgrade/boaredhsb/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 09 Dec 2020 06:33:40 GMT Content-Encoding gzip Last-Modified Tue, 01 Dec 2020 02:23:36 GMT Server Apache Vary Accept-Encoding Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 2228

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Bank of America (Banking)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| setImmediate function| clearImmediate function| Vue

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			pandp64.co.uk/	1970-01-19 14:31:42	Name: cazanova Value: 6252cb22db8c55a76d438baf9ad61eb12a3d0958

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

pandp64.co.uk
picestudios.com
www.joytogroup.com
212.34.145.211
213.5.71.103
80.247.175.21
40da96affd2e33d1ed551dcc376c09737126a0439ec7cc8d07a9275b74641276
507ea8a27c8892c5461063d3a2c1534c5c847c48577f60d3a0ffb441c3c518ca
7b0159b18a5fbaea723b6b95de2f895aee4e41db740e241599c86bbb6f6f1988
dff0c27bdad608038fbe31ab75fe341d9fe4fdf612b0b887a8324f09d7e345e3
ea771cbf42a69918c0f50d76bf7b318ea505715f81dcd60e6b264967ea488793
eaebf773bdb28b798e72b6296512a5c4b947d7d7b9b8289dda9bd846b41352d1