kits.z35.web.core.windows.net Open in urlscan Pro
51.140.232.69 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://kits.z35.web.core.windows.net/
Submission: On August 06 via manual (August 6th 2020, 11:31:04 am UTC) from IN

Summary HTTP 8 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 8 HTTP transactions. The main IP is 51.140.232.69, located in Cardiff, United Kingdom and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is kits.z35.web.core.windows.net.
TLS certificate: Issued by Microsoft IT TLS CA 2 on July 20th 2020. Valid for: 2 years.

This is the only time kits.z35.web.core.windows.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: UK Government (Government)

Domain & IP information

	IP Address	AS Autonomous System
5	51.140.232.69 51.140.232.69	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2a00:1450:400... 2a00:1450:4001:824::2003	15169 (GOOGLE) (GOOGLE)
1	23.36.232.204 23.36.232.204	16625 (AKAMAI-AS) (AKAMAI-AS)
8	3

5 51.140.232.69 (Cardiff, United Kingdom)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

kits.z35.web.core.windows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:824::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.36.232.204 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-36-232-204.deploy.static.akamaitechnologies.com

developer.service.hmrc.gov.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	windows.net kits.z35.web.core.windows.net	6 MB
2	gstatic.com fonts.gstatic.com	119 KB
1	hmrc.gov.uk developer.service.hmrc.gov.uk	4 KB
8	3

	Domain	Requested by
5	kits.z35.web.core.windows.net	kits.z35.web.core.windows.net
2	fonts.gstatic.com	kits.z35.web.core.windows.net
1	developer.service.hmrc.gov.uk
8	3

This site contains links to these domains. Also see Links.

Domain
www.nationalarchives.gov.uk

Subject Issuer	Validity	Valid
*.web.core.windows.net Microsoft IT TLS CA 2	`2020-07-20` - `2022-07-20`	2 years	crt.sh
*.gstatic.com GTS CA 1O1	`2020-07-07` - `2020-09-29`	3 months	crt.sh
online.hmrc.gov.uk DigiCert SHA2 Extended Validation Server CA	`2020-01-31` - `2021-04-16`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://kits.z35.web.core.windows.net/
Frame ID: 4A033218B93E1917CDB269C6A03E9062
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Microsoft HTTPAPI (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /Microsoft-HTTPAPI(?:\/([\d.]+))?/i

Page Statistics

8
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

6016 kB
Transfer

6089 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/
Title: Open Government Licence v3.0

Search URL Search Domain Scan URL

URL: https://www.nationalarchives.gov.uk/information-management/re-using-public-sector-information/uk-government-licensing-framework/crown-copyright/
Title: © Crown copyright

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
kits.z35.web.core.windows.net/ 5 KB
5 KB 274ms
45ms Document
text/html 51.140.232.69
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://kits.z35.web.core.windows.net/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 51.140.232.69 Cardiff, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: f0dc7d0557f8dff5d6619a3cc3d5d111d02ea9c035348470613de170a03dc08e

Request headers

Host: kits.z35.web.core.windows.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Length: 5074
Content-Type: text/html
Content-MD5: n6TumOtv5xrLRKBaZnfccg==
Last-Modified: Mon, 27 Jul 2020 10:49:18 GMT
Accept-Ranges: bytes
ETag: "0x8D8321AB6732CE6"
Vary: Origin
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: fbc894e6-a01e-0012-51e5-6bf7bd000000
x-ms-version: 2018-03-28
Date: Thu, 06 Aug 2020 11:30:47 GMT

GET
H/1.1 200
OK theme.css
kits.z35.web.core.windows.net/styles/ 55 KB
56 KB 65ms
64ms Stylesheet
text/css 51.140.232.69
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://kits.z35.web.core.windows.net/styles/theme.css
Requested by: Host: kits.z35.web.core.windows.net
URL: https://kits.z35.web.core.windows.net/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 51.140.232.69 Cardiff, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 1901717ddd94872bbb3947fa0814622fa7c8888d7f955389cd0c803fa8d48f4f

Request headers

Referer: https://kits.z35.web.core.windows.net/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 06 Aug 2020 11:30:47 GMT
Last-Modified: Mon, 27 Jul 2020 10:49:31 GMT
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
Content-MD5: dWqXRl+6ufWAvoU2wp8svw==
ETag: "0x8D8321ABE736A9F"
Vary: Origin
Content-Type: text/css
x-ms-request-id: fbc8950a-a01e-0012-66e5-6bf7bd000000
x-ms-version: 2018-03-28
Accept-Ranges: bytes
Content-Length: 56760

GET
H/1.1 200
OK theme.js Show response
kits.z35.web.core.windows.net/scripts/ 6 MB
6 MB 159ms
74ms Script
application/javascript 51.140.232.69
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://kits.z35.web.core.windows.net/scripts/theme.js
Requested by: Host: kits.z35.web.core.windows.net
URL: https://kits.z35.web.core.windows.net/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 51.140.232.69 Cardiff, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 77268a4cb7e9406983df3949c8304a67217d81b54759e0051b30f1b06b92e3fa

Request headers

Referer: https://kits.z35.web.core.windows.net/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 06 Aug 2020 11:30:47 GMT
Last-Modified: Mon, 27 Jul 2020 10:49:31 GMT
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
Content-MD5: +y1LD02tD0vk2TVDhGF47A==
ETag: "0x8D8321ABE29AA04"
Vary: Origin
Content-Type: application/javascript
x-ms-request-id: d7765dc2-501e-000c-05e5-6b2d50000000
x-ms-version: 2018-03-28
Accept-Ranges: bytes
Content-Length: 5947696

GET
H/1.1 200
OK styles.css
kits.z35.web.core.windows.net/styles/ 15 KB
15 KB 111ms
27ms Stylesheet
text/css 51.140.232.69
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://kits.z35.web.core.windows.net/styles/styles.css
Requested by: Host: kits.z35.web.core.windows.net
URL: https://kits.z35.web.core.windows.net/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 51.140.232.69 Cardiff, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: ffbf0e983f8aff0c1329d3a3095e4f38f24afc9b5dd2170ddce57de914f65b73

Request headers

Referer: https://kits.z35.web.core.windows.net/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 06 Aug 2020 11:30:47 GMT
Last-Modified: Mon, 27 Jul 2020 10:49:31 GMT
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
Content-MD5: F6Rjd98DLZa52UJfAABUGg==
ETag: "0x8D8321ABE642598"
Vary: Origin
Content-Type: text/css
x-ms-request-id: fbc8954c-a01e-0012-0be5-6bf7bd000000
x-ms-version: 2018-03-28
Accept-Ranges: bytes
Content-Length: 15406

GET
H/1.1 200
OK styles.css
kits.z35.web.core.windows.net/ 7 KB
7 KB 114ms
30ms Stylesheet
text/css 51.140.232.69
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://kits.z35.web.core.windows.net/styles.css
Requested by: Host: kits.z35.web.core.windows.net
URL: https://kits.z35.web.core.windows.net/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 51.140.232.69 Cardiff, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: a6f377f7dbd34463b6c556825b164e5f317196b338542d5fa0b88122236f6226

Request headers

Referer: https://kits.z35.web.core.windows.net/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 06 Aug 2020 11:30:47 GMT
Last-Modified: Mon, 27 Jul 2020 10:49:18 GMT
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
Content-MD5: V85gz8YVvYWARYq6KJ6b3A==
ETag: "0x8D8321AB69008F6"
Vary: Origin
Content-Type: text/css
x-ms-request-id: 9f3aaeba-f01e-0023-59e5-6bac6a000000
x-ms-version: 2018-03-28
Accept-Ranges: bytes
Content-Length: 6929

GET
H2 200 mem8YaGs126MiZpBA-U1UpcaXcl0Aw.ttf
fonts.gstatic.com/s/opensans/v16/ 94 KB
58 KB 7ms
7ms Font
font/ttf 2a00:1450:4001:824::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v16/mem8YaGs126MiZpBA-U1UpcaXcl0Aw.ttf

Requested by

Host: kits.z35.web.core.windows.net
URL: https://kits.z35.web.core.windows.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

34ad67cfc362403e3baabe4ad0f4ef0b4b6b68e2f252dd703bbb1e10198188e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://kits.z35.web.core.windows.net/styles/styles.css
Origin: https://kits.z35.web.core.windows.net

Response headers

date: Thu, 23 Jul 2020 02:34:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1241774
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 59475
x-xss-protection: 0
last-modified: Mon, 25 Mar 2019 20:12:35 GMT
server: sffe
vary: Accept-Encoding
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 23 Jul 2021 02:34:34 GMT

GET
H2 200 mem5YaGs126MiZpBA-UN7rg-VeJoCqeDjg.ttf
fonts.gstatic.com/s/opensans/v16/ 101 KB
61 KB 10ms
10ms Font
font/ttf 2a00:1450:4001:824::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v16/mem5YaGs126MiZpBA-UN7rg-VeJoCqeDjg.ttf

Requested by

Host: kits.z35.web.core.windows.net
URL: https://kits.z35.web.core.windows.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a7a41b04969454dfbe620bfbc7699647b2819d768374b3f0f90a714a0d80b199

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://kits.z35.web.core.windows.net/styles/styles.css
Origin: https://kits.z35.web.core.windows.net

Response headers

date: Mon, 27 Jul 2020 22:56:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 822841
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 62386
x-xss-protection: 0
last-modified: Mon, 25 Mar 2019 20:13:00 GMT
server: sffe
vary: Accept-Encoding
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 27 Jul 2021 22:56:47 GMT

GET
H/1.1 200
OK govuk-crest.png
developer.service.hmrc.gov.uk/template/assets/stylesheets/images/ 4 KB
4 KB 364ms
17ms Image
image/png 23.36.232.204
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://developer.service.hmrc.gov.uk/template/assets/stylesheets/images/govuk-crest.png

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.36.232.204 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-36-232-204.deploy.static.akamaitechnologies.com

Software

Resource Hash

bb9e22aff7881b895c2ceb41d9340804451c474b883f09fe1b4026e76456f44b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://kits.z35.web.core.windows.net/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000;
X-Content-Type-Options: nosniff
Last-Modified: Wed, 01 Apr 2020 11:19:06 GMT
x-amz-request-id: BA71E37F79290879
ETag: "bcd5768bd7721641ee71ba103bb38900"
X-Frame-Options: DENY
x-amz-id-2: 72o0eFPeNCvxZQPgtQr8+Dt8WA4qp12L4eB1PxDU/uDvP+LoIPw6gDxieS5EknEwtW4cXzKo+wI=
Content-Type: image/png
Cache-Control: public, max-age=31201216
Date: Thu, 06 Aug 2020 11:30:49 GMT
Connection: keep-alive
Content-Length: 3584
X-XSS-Protection: 1; mode=block

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: UK Government (Government)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	error	URL: https://kits.z35.web.core.windows.net/scripts/theme.js(Line 98534) Message: undefined

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

developer.service.hmrc.gov.uk
fonts.gstatic.com
kits.z35.web.core.windows.net
23.36.232.204
2a00:1450:4001:824::2003
51.140.232.69
1901717ddd94872bbb3947fa0814622fa7c8888d7f955389cd0c803fa8d48f4f
34ad67cfc362403e3baabe4ad0f4ef0b4b6b68e2f252dd703bbb1e10198188e2
77268a4cb7e9406983df3949c8304a67217d81b54759e0051b30f1b06b92e3fa
a6f377f7dbd34463b6c556825b164e5f317196b338542d5fa0b88122236f6226
a7a41b04969454dfbe620bfbc7699647b2819d768374b3f0f90a714a0d80b199
bb9e22aff7881b895c2ceb41d9340804451c474b883f09fe1b4026e76456f44b
f0dc7d0557f8dff5d6619a3cc3d5d111d02ea9c035348470613de170a03dc08e
ffbf0e983f8aff0c1329d3a3095e4f38f24afc9b5dd2170ddce57de914f65b73

kits.z35.web.core.windows.net Open in urlscan Pro 51.140.232.69 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

8 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

6016 kBTransfer

6089 kBSize

0 Cookies

2 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

kits.z35.web.core.windows.net Open in urlscan Pro
51.140.232.69 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

6016 kB
Transfer

6089 kB
Size

0
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!