www.cadkams.com
Open in
urlscan Pro
108.179.246.86
Malicious Activity!
Public Scan
URL:
http://www.cadkams.com/slc/index.php?email=terry@netcomp.ltd.uk
Submission: On September 24 via manual from GB
Submission: On September 24 via manual from GB
Summary
This website contacted 4 IPs
in 3 countries
across 3 domains to perform 16 HTTP transactions.
The main IP is 108.179.246.86, located in
Houston, United States and
belongs to CYRUSONE - CyrusOne LLC, US.
The main domain is www.cadkams.com.
This is the only time www.cadkams.com was scanned on urlscan.io!
This is the only time www.cadkams.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: UK Government (Government)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 10 | 108.179.246.86 108.179.246.86 | 20013 (CYRUSONE) (CYRUSONE - CyrusOne LLC) | |
| 5 | 62.255.142.225 62.255.142.225 | 5089 (NTL) (NTL) | |
| 1 | 2a00:1450:400... 2a00:1450:4001:812::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
| 16 | 4 |
5
62.255.142.225
(Wokingham, United Kingdom)
ASN5089 (NTL, GB)
PTR: 225.142-255-62.static.virginmediabusiness.co.uk
ASN5089 (NTL, GB)
PTR: 225.142-255-62.static.virginmediabusiness.co.uk
| logon.slc.co.uk |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 10 |
cadkams.com
www.cadkams.com |
5 KB |
| 5 |
slc.co.uk
logon.slc.co.uk |
214 KB |
| 1 |
googleapis.com
fonts.googleapis.com |
1 KB |
| 16 | 3 |
| Domain | Requested by | |
|---|---|---|
| 10 | www.cadkams.com |
www.cadkams.com
|
| 5 | logon.slc.co.uk |
www.cadkams.com
|
| 1 | fonts.googleapis.com |
www.cadkams.com
|
| 16 | 3 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.slc.co.uk |
| logon.slc.co.uk |
| www.student-finance.service.gov.uk |
| www.surveygizmo.eu |
| www.nationalarchives.gov.uk |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| logon.slc.co.uk DigiCert SHA2 Secure Server CA |
2018-03-23 - 2019-03-27 |
a year | crt.sh |
| *.googleapis.com Google Internet Authority G3 |
2018-08-28 - 2018-11-20 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://www.cadkams.com/slc/index.php?email=terry@netcomp.ltd.uk
Frame ID: D99FF9D06B5CF3E0B92C777724541245
Requests: 18 HTTP requests in this frame
Screenshot
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- url /\.php(?:$|\?)/i
Nginx
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Google Font API
(Font Scripts)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
- script /jquery.*\.js/i
Page Statistics
12 Outgoing links
These are links going to different origins than the main page.
URL: https://www.slc.co.uk/media/9880/dps_privacy_notice.pdf
Title: Privacy notice
Title: Privacy notice
Search URL Search Domain Scan URL
URL: https://logon.slc.co.uk/reset/pages/ForgotCRN.xhtml?_locale=en_GB
Title: Forgotten your email address or CRN?
Title: Forgotten your email address or CRN?
Search URL Search Domain Scan URL
URL: https://logon.slc.co.uk/reset/pages/ForgotPassword.xhtml?_locale=en_GB
Title: Forgotten your password?
Title: Forgotten your password?
Search URL Search Domain Scan URL
URL: https://www.student-finance.service.gov.uk/customer/registration/pages/VerifyStudent.xhtml?_locale=en_GB
Title: Create an account
Title: Create an account
Search URL Search Domain Scan URL
URL: https://www.student-finance.service.gov.uk/customer/information-and-guidance/pages/cookies?_locale=en_GB
Title: Cookies
Title: Cookies
Search URL Search Domain Scan URL
URL: https://www.student-finance.service.gov.uk/customer/information-and-guidance/pages/e-privacy?_locale=en_GB
Title: e-Privacy
Title: e-Privacy
Search URL Search Domain Scan URL
URL: https://www.student-finance.service.gov.uk/customer/information-and-guidance/pages/terms-of-use?_locale=en_GB
Title: Terms of Use
Title: Terms of Use
Search URL Search Domain Scan URL
URL: https://www.student-finance.service.gov.uk/customer/information-and-guidance/pages/security?_locale=en_GB
Title: Security
Title: Security
Search URL Search Domain Scan URL
URL: https://www.student-finance.service.gov.uk/customer/information-and-guidance/pages/accessibility?_locale=en_GB
Title: Accessibility
Title: Accessibility
Search URL Search Domain Scan URL
URL: http://www.surveygizmo.eu/s3/90058663/18-19-SFE-LARA?Pcode=1
Title: Feedback
Title: Feedback
Search URL Search Domain Scan URL
URL: http://www.slc.co.uk/
Title: Student Loans Company
Title: Student Loans Company
Search URL Search Domain Scan URL
URL: http://www.nationalarchives.gov.uk/information-management/our-services/crown-copyright.htm
Title: © Crown Copyright
Title: © Crown Copyright
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
index.php
www.cadkams.com/slc/ |
13 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
global.css
logon.slc.co.uk/aut-res/global/styles/ |
34 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
govuk.css
logon.slc.co.uk/aut-res/dgv/styles/ |
275 KB 198 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
slc_browser.js
www.cadkams.com/slc/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-1.7.2.js
www.cadkams.com/slc/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.simplemodal-1.4.2.js
www.cadkams.com/slc/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
slc_trackeventhandler.js
www.cadkams.com/slc/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
css
fonts.googleapis.com/ |
19 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
slc_analytics.js
www.cadkams.com/slc/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
govuk-crown.png
logon.slc.co.uk/aut-res/global/images/ |
780 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
SFElogo.png
logon.slc.co.uk/aut-res/dgv/images/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-1.7.2.js
www.cadkams.com/slc/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.simplemodal-1.4.2.js
www.cadkams.com/slc/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
slc_trackeventhandler.js
www.cadkams.com/slc/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
slc_analytics.js
www.cadkams.com/slc/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
94 KB 0 |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
71 KB 0 |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
govuk-crest.png
logon.slc.co.uk/aut-res/global/images/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: UK Government (Government)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
string| universalAccount string| universalDomainList object| universalUid string| ssLocale0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
logon.slc.co.uk
www.cadkams.com
108.179.246.86
2a00:1450:4001:812::200a
62.255.142.225
01c73d5dd84423dd2fc30aabd1de09a86b36b6de9e2e240d954c09cbb1d97aba
048b93884a1b51d20f2a3140541d450cb6b82c6c2cf69128ea1d09fdd9699f30
14b98db97bbd6cb1f33935d3e0d973fa68ca0c38fb5762b033423ceffe9e16f6
56cccac86445aa56bfd54e9b5d0117c83493457ac8e1ed89e858abc1ac7cab7e
90f8638010cdd1735d35f71ab873cbdf1aee93e0d40a2f2f115365e8e421ca0d
9302d96960130863fa227d00d5bbf9a746243efb978dd015c0707b59b04f5c1e
bb9e22aff7881b895c2ceb41d9340804451c474b883f09fe1b4026e76456f44b
d3a2799d1ed0c81e47da5fc78bede8ca5617e7d92b80a6fccc2e223f4fabc549
f3c14820d452cf53db3283d280fd0c14da7e1424595bd4a56a537af9b3b88cb1