uk.ansonng.us Open in urlscan Pro
2606:4700:3033::ac43:d7bc Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://uk.ansonng.us/
Submission: On December 21 via api (December 21st 2023, 11:11:20 pm UTC) from US — Scanned from US

Summary HTTP 13 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 13 HTTP transactions. The main IP is 2606:4700:3033::ac43:d7bc, located in United States and belongs to CLOUDFLARENET, US. The main domain is uk.ansonng.us.
TLS certificate: Issued by GTS CA 1P5 on December 21st 2023. Valid for: 3 months.

This is the only time uk.ansonng.us was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: UK Government (Government)

Domain & IP information

	IP Address		AS Autonomous System
2 15	2606:4700:303... 2606:4700:3033::ac43:d7bc		13335 (CLOUDFLAR...) (CLOUDFLARENET)
13	1

15 2606:4700:3033::ac43:d7bc (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

uk.ansonng.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	ansonng.us 2 redirects uk.ansonng.us	138 KB
13	1

	Domain	Requested by
15	uk.ansonng.us	2 redirects uk.ansonng.us
13	1

This site contains links to these domains. Also see Links.

Domain
www.nationalarchives.gov.uk

Subject Issuer	Validity	Valid
uk.ansonng.us GTS CA 1P5	`2023-12-21` - `2024-03-20`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://uk.ansonng.us/
Frame ID: 4F9ECBD34340C65E64140DF2814859D6
Requests: 9 HTTP requests in this frame

Frame: https://uk.ansonng.us/cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/main.js
Frame ID: 60774F21B43613A91C41DC51072481A3
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Customised – Page template – Example - GOV.UK Design SystemGOV.UK

Detected technologies

GOV.UK Frontend (UI frameworks) Expand

Overall confidence: 80%
Detected patterns

<body[^>]+govuk-template__body
<a[^>]+govuk-link

Page Statistics

13
Requests

85 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

137 kB
Transfer

356 kB
Size

1
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/
Title: Open Government Licence v3.0

Search URL Search Domain Scan URL

URL: https://www.nationalarchives.gov.uk/information-management/re-using-public-sector-information/uk-government-licensing-framework/crown-copyright/
Title: © Crown copyright

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 7

https://uk.ansonng.us/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
https://uk.ansonng.us/cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/main.js

Request Chain 10

https://uk.ansonng.us/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
https://uk.ansonng.us/cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/main.js

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
uk.ansonng.us/ 11 KB
5 KB 325ms
208ms Document
text/html 2606:4700:3033::ac43:d7bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://uk.ansonng.us/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3033::ac43:d7bc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

206ce234d16603a2816ab9d72c369ec46d36f5b4a0f493e110bb9fc10180764d

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=0, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 8393cd944ce8b3b9-MIA
content-encoding: br
content-type: text/html; charset=utf-8
date: Thu, 21 Dec 2023 23:11:14 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=f14%2F3VmbQsLUZg5VxGmE162%2FzVduVP7Lqi1NGhvSHUMGhpr6JtI0IEWVSA32ScChFaiou02etSdAob%2BiD4hbx5aJ3y6w69vdzPc3nh9xx9BKyiK6OeYkSMgaQWrPWH7ghhZgyMRIJKFJv%2Fth"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=0; includeSubDomains; preload
vary: Accept-Encoding
x-content-type-options: nosniff

GET
H2 200 s9tf14vrd7g3xzI8VjVHsx7W5ZU.js Show response
uk.ansonng.us/cdn-cgi/apps/head/ 5 KB
2 KB 261ms
259ms Script
application/javascript 2606:4700:3033::ac43:d7bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://uk.ansonng.us/cdn-cgi/apps/head/s9tf14vrd7g3xzI8VjVHsx7W5ZU.js

Requested by

Host: uk.ansonng.us
URL: https://uk.ansonng.us/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3033::ac43:d7bc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b3de67fe516082dd5aa155342f89e667977a9d7e0127f3aa0ab6af0ef3b5c73d

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://uk.ansonng.us/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 23:11:15 GMT
x-amz-version-id: g22SFBDVWNiAetQLXzSUT85.IEZfUj5K
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=0; includeSubDomains; preload
x-amz-request-id: 5Y3WWK7HK2M2CR19
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-amz-id-2: ibb/0n5Uh/R9Jno/qRMxJxiogB384DE/BUBiS5MuTT7WMg6eUnWunn9WJJCOs3jldkhi9/X5jnA=
last-modified: Tue, 19 Dec 2023 20:12:01 GMT
server: cloudflare
etag: W/"0a564f4317f7da30d90b6ae907623761"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uXoUPp2XCgv9CbItlJrI0NJytxP3pjAUWypPfzR0dojX1zyUReRjcXK4ckhxsWlsCByKfUXuWc6%2FM%2Fy4DFd%2BtFiOTZr1f63uAXSB%2F59d%2BEk6x8ejuAwzcN%2B0l1N3vbu82%2BxhzLXaUgvgggUe"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 8393cd95aebdb3b9-MIA

GET
H2 200 style.css
uk.ansonng.us/ 147 KB
20 KB 341ms
341ms Stylesheet
text/css 2606:4700:3033::ac43:d7bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://uk.ansonng.us/style.css

Requested by

Host: uk.ansonng.us
URL: https://uk.ansonng.us/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3033::ac43:d7bc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7d8139e4965ff3e9bdccb78c81f3373fbcd07761770189250b95914929088cf1

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://uk.ansonng.us/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 23:11:15 GMT
strict-transport-security: max-age=0; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"c892daa0f1029e2f35b1cd17a7916074"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SKKi0CcwEJeUNqCgs4h%2BzZjBd1WVxMCRsVSp7gOBHTgmGIB2%2FRyglQi4fkNFcxCDGoBIwn1KBO2YzqcCHe5O6R2Ni%2BV7EPwW8foa%2FQa2fLywEopcVrvgLF%2FE33Y3NrDapDQ0M8lm5yEtZ%2Boi"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=120, must-revalidate
cf-ray: 8393cd95aebbb3b9-MIA

GET
H3 200 rocket-loader.min.js Show response
uk.ansonng.us/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ 12 KB
4 KB 38ms
37ms Script
application/javascript 2606:4700:3033::ac43:d7bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://uk.ansonng.us/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Requested by

Host: uk.ansonng.us
URL: https://uk.ansonng.us/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::ac43:d7bc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://uk.ansonng.us/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 23:11:15 GMT
strict-transport-security: max-age=0; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Tue, 19 Dec 2023 14:09:38 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: gzip
etag: W/"6581a422-302c"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0VK0IiDiFEXdfEcfoV%2FiW%2FePLJPXsfGwyvYQM1FqHqdVgqV%2FQkogsUtFKMo3qaOa%2Fh1cJH9nuwEd1i6dd7fxSR0NPUQS09U%2Fq4Qs2QRZva%2BVuLncMCwxqSi7538n1gLLWWEK8DeLrOlruuIB"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-frame-options: DENY
cache-control: max-age=172800, public
cf-ray: 8393cd9749882286-MIA
expires: Sat, 23 Dec 2023 23:11:15 GMT

GET
H3 200 govuk-crest.png
uk.ansonng.us/assets/images/ 4 KB
4 KB 222ms
219ms Image
image/png 2606:4700:3033::ac43:d7bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://uk.ansonng.us/assets/images/govuk-crest.png

Requested by

Host: uk.ansonng.us
URL: https://uk.ansonng.us/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::ac43:d7bc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bb9e22aff7881b895c2ceb41d9340804451c474b883f09fe1b4026e76456f44b

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://uk.ansonng.us/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 23:11:15 GMT
strict-transport-security: max-age=0; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 3584
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: "18bd165c73210450fbfcb8e12e7ea401"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lxRdrBj1XatwyNN5dmnO2c1yrZPv0lQiy2dNtq72ORHuoHB14OAEfMNza2XdQD6twoIc6NWkeMz5rZTcilp47%2BjVI2aONp5IDeF7sst6NrYt%2Fw833lkv9JO%2BInKKs8%2FXCfHcTFxW4lrDXPqe"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=120, must-revalidate
accept-ranges: bytes
cf-ray: 8393cd97dac72286-MIA

GET
H3 200 bold-b542beb274-v2.woff2
uk.ansonng.us/assets/fonts/ 31 KB
31 KB 246ms
244ms Font
font/woff2 2606:4700:3033::ac43:d7bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://uk.ansonng.us/assets/fonts/bold-b542beb274-v2.woff2

Requested by

Host: uk.ansonng.us
URL: https://uk.ansonng.us/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::ac43:d7bc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

06eba01b1af0f4014b484c711771fef1db30becbf0edf481498da1e4958d3d47

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://uk.ansonng.us/style.css
Origin: https://uk.ansonng.us
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 23:11:15 GMT
strict-transport-security: max-age=0; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 31480
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: "55fdd379ad11ddc09197e4423591c8fb"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ah%2FhYHHaovF%2F7eRf7wOgCnwT2UprtENZW%2FNEP7V8t9SzEtrDcmSiBrXpDZQT8SCCv7SmigJv9bUNg8VpJkmm68kseN2oaoDObJl4BAUPPoEPOXtWWCnSKnLh3t33xf1EzbwixYQ0EIhdyGf%2F"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=120, must-revalidate
accept-ranges: bytes
cf-ray: 8393cd97daca2286-MIA

GET
H3 200 light-94a07e06a1-v2.woff2
uk.ansonng.us/assets/fonts/ 33 KB
33 KB 313ms
312ms Font
font/woff2 2606:4700:3033::ac43:d7bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://uk.ansonng.us/assets/fonts/light-94a07e06a1-v2.woff2

Requested by

Host: uk.ansonng.us
URL: https://uk.ansonng.us/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::ac43:d7bc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eedfb3c2f7945caebd0b15522b59d6c7f01be17fecd6102fd76452ad4042f7b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://uk.ansonng.us/style.css
Origin: https://uk.ansonng.us
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 23:11:15 GMT
strict-transport-security: max-age=0; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 33382
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: "bc7ecbf428a5af1ea457e212eaf70a82"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Hecaok1NjYNL0RG3FbPxkWYHAzCMj74smbTryVEduS0n9Q4UukZKrgJhtG8INsXAEPlZmMYZvBlRZBD%2FJ6k04%2Bp9hzs%2B7sciEhJw6yq2URok9xL0%2B%2FeR7%2F5PJbzdKBIEFdjI3s71XHmPjq87"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=120, must-revalidate
accept-ranges: bytes
cf-ray: 8393cd97dace2286-MIA

GET
H3 200 js.js Show response
uk.ansonng.us/ 50 KB
15 KB 249ms
249ms Script
application/javascript 2606:4700:3033::ac43:d7bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://uk.ansonng.us/js.js

Requested by

Host: uk.ansonng.us
URL: https://uk.ansonng.us/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::ac43:d7bc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7a2594afcd785bf710f7ff4373b3f5134db00651b1e28d35b8b2dcdd87bc4494

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://uk.ansonng.us/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 23:11:15 GMT
strict-transport-security: max-age=0; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"06bc6adfee58a4eccbb5a7c67a4e2c12"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=x43aCSeq3XO56lhCU3TlaF0hpNOdOtG2V%2B%2BGtSOLkj2hGEgpZcilBR9hxCqIhap6cq8vVl9c3HFgnqFx0hqgol9FSFGwk5RXAC%2BhcrFolygYl7bgtUtJwPXBY77HAj6l2Rmkto8%2BEx72tN0v"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=120, must-revalidate
cf-ray: 8393cd983b2f2286-MIA

GET
H3

200

main.js Show response
uk.ansonng.us/cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/ Frame 6077
Redirect Chain

https://uk.ansonng.us/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://uk.ansonng.us/cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/main.js

7 KB
4 KB

42ms
42ms

Script
application/javascript

2606:4700:3033::ac43:d7bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://uk.ansonng.us/cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/main.js

Requested by

Host: uk.ansonng.us
URL: https://uk.ansonng.us/

Protocol

Server

2606:4700:3033::ac43:d7bc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

566461f27f0cd39591c172f4a42534191cd7d64cc6e9490627b3a6931809517f

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 23:11:15 GMT
strict-transport-security: max-age=0; includeSubDomains; preload
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WUBrVj7FUOOVdRdKDx%2BXkb5KhL2ZwcWiEHN8qzkI18YXAYn0u6RZgZWMDnaFQspqXPSEYZAkxYUgfKoFNWefwGX6nlqOTQZIJ2QBODRbJghTucnPtPFC4hbo5PJcZii17yzYJGY2EyU8tPdT"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
cf-ray: 8393cd989bb72286-MIA
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Thu, 21 Dec 2023 23:11:15 GMT
strict-transport-security: max-age=0; includeSubDomains; preload
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=K%2F0bKrHKY368odCXxn2XX5zHRuF6e4HzHRiVyE5n5%2B4ctMZ4xmhmTaJLkgz3QIYeMv5tfFAiHr1vQ0qdrVRWy08z4k5svQoljCMXeg3gOdTomVoPQBfWor8ll%2BHoyJFOJIThwQ1PRGNpiwpy"}],"group":"cf-nel","max_age":604800}
location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/main.js
access-control-allow-origin: *
cache-control: max-age=300, public
cf-ray: 8393cd984b5a2286-MIA
alt-svc: h3=":443"; ma=86400

POST
H3 200 8393cd944ce8b3b9 Show response
uk.ansonng.us/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame 6077 0
585 B 63ms
58ms XHR
text/plain 2606:4700:3033::ac43:d7bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://uk.ansonng.us/cdn-cgi/challenge-platform/h/g/jsd/r/8393cd944ce8b3b9

Requested by

Host: uk.ansonng.us
URL: https://uk.ansonng.us/cdn-cgi/challenge-platform/scripts/jsd/main.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::ac43:d7bc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 21 Dec 2023 23:11:15 GMT
strict-transport-security: max-age=0; includeSubDomains; preload
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1y588r%2B0jZsBQX2mux2Al%2FySLfgFDbE14AfB4NgoX2pHNXJqRHhdF5WzDn52IYhXTdQb2z3MHKYK28SWyE135ebLKa%2F2VtTbWSGKAy7I%2F1%2B5e53Z4I1juHGT8BWpvXzj2qSo%2BlDzgo3eVA6%2F"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=UTF-8
cf-ray: 8393cd9a5dcf2286-MIA
alt-svc: h3=":443"; ma=86400

GET
H3 200 js.js Show response
uk.ansonng.us/ 50 KB
15 KB 91ms
90ms Script
application/javascript 2606:4700:3033::ac43:d7bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://uk.ansonng.us/js.js

Requested by

Host: uk.ansonng.us
URL: https://uk.ansonng.us/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::ac43:d7bc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7a2594afcd785bf710f7ff4373b3f5134db00651b1e28d35b8b2dcdd87bc4494

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://uk.ansonng.us/
Origin: https://uk.ansonng.us
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 23:11:15 GMT
strict-transport-security: max-age=0; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"06bc6adfee58a4eccbb5a7c67a4e2c12"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VKTLrl%2Ba8AtZM3iQTr6zL5hzZOb1L2W54s%2Bo%2BHaEjyh7XpmfgampilEWlmU3ww715zpyomWEcUdBF5Lh9mmUwmumC2NnA88mhVpw%2BXgW8VliGOnrDdK%2F0pcYNSY4cco9YylSw2k4EDooMZ%2FK"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=120, must-revalidate
cf-ray: 8393cd9a7e212286-MIA

GET
H3

200

main.js Show response
uk.ansonng.us/cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/ Frame 6077
Redirect Chain

https://uk.ansonng.us/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://uk.ansonng.us/cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/main.js

7 KB
4 KB

44ms
43ms

Script
application/javascript

2606:4700:3033::ac43:d7bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://uk.ansonng.us/cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/main.js

Protocol

Server

2606:4700:3033::ac43:d7bc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

21ba6918ae05e02a4ace1e965fc26025cd3657a9e9ca9635685118f1b3dbd69d

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 23:11:15 GMT
strict-transport-security: max-age=0; includeSubDomains; preload
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=erOH6%2FbkZgyEAgJiGUZ%2B1hzx3LSF56g%2F1T4VYrlSWG9iL3cQY8a3rWYK4CgXXKVM3nJ4DN1Ut20ub%2BAgCU8NvDk%2FxsZy%2BNrnw9j1LOiwPDBsRUu1FpnOLN7K8pUg0FiMJ5glpE7gm0FftrqQ"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
cf-ray: 8393cd9b5f592286-MIA
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Thu, 21 Dec 2023 23:11:15 GMT
strict-transport-security: max-age=0; includeSubDomains; preload
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E7wW1jbNVbSBPPJzxINYOUujbEztazxx9ZKvEZBdfNP0vTTCIDoOEoqMn3U%2BeOGdjgHDD5Zt3MT1uHYAdKf0wjkuC%2BIR9v3Ljh%2FqdmKJRVvMs4WQqH8MyITdzyYexvqMzYIhjwNqXEBgqitZ"}],"group":"cf-nel","max_age":604800}
location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/main.js
access-control-allow-origin: *
cache-control: max-age=300, public
cf-ray: 8393cd9b1edb2286-MIA
alt-svc: h3=":443"; ma=86400

POST
H3 200 8393cd944ce8b3b9 Show response
uk.ansonng.us/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame 6077 0
580 B 54ms
51ms XHR
text/plain 2606:4700:3033::ac43:d7bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://uk.ansonng.us/cdn-cgi/challenge-platform/h/g/jsd/r/8393cd944ce8b3b9

Requested by

Host: uk.ansonng.us
URL: https://uk.ansonng.us/cdn-cgi/challenge-platform/scripts/jsd/main.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::ac43:d7bc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 21 Dec 2023 23:11:16 GMT
strict-transport-security: max-age=0; includeSubDomains; preload
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=soAi1ysTADv%2B2Gu7Fzg6y3Dt4FDCPrRMd055XheoRKBscWeUTrg0RS%2FKKruWAx%2F8lvbYepdcshPjQh%2BNt8CpIQD52hSVjUKouURR08xhUXUvYHObFYXvqQxo1XKIaPeW0MAIgcC8khRrGo1L"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=UTF-8
cf-ray: 8393cd9d29582286-MIA
alt-svc: h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: UK Government (Government)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.ansonng.us/	1970-01-21 01:52:16	Name: cf_clearance Value: ut74Ry9ZfQ7SWjc8xKKX3fMPWMoT0fcD2nvdCVUpzuI-1703200276-0-2-367f4716.efec051d.cedb0c17-0.2.1703200276

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://uk.ansonng.us/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js Message: A preload for 'https://uk.ansonng.us/js.js' is found, but is not used because the request credentials mode does not match. Consider taking a look at crossorigin attribute.
javascript	warning	URL: https://uk.ansonng.us/ Message: The resource https://uk.ansonng.us/js.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

uk.ansonng.us
2606:4700:3033::ac43:d7bc
06eba01b1af0f4014b484c711771fef1db30becbf0edf481498da1e4958d3d47
206ce234d16603a2816ab9d72c369ec46d36f5b4a0f493e110bb9fc10180764d
21ba6918ae05e02a4ace1e965fc26025cd3657a9e9ca9635685118f1b3dbd69d
566461f27f0cd39591c172f4a42534191cd7d64cc6e9490627b3a6931809517f
7a2594afcd785bf710f7ff4373b3f5134db00651b1e28d35b8b2dcdd87bc4494
7d8139e4965ff3e9bdccb78c81f3373fbcd07761770189250b95914929088cf1
b3de67fe516082dd5aa155342f89e667977a9d7e0127f3aa0ab6af0ef3b5c73d
bb9e22aff7881b895c2ceb41d9340804451c474b883f09fe1b4026e76456f44b
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eedfb3c2f7945caebd0b15522b59d6c7f01be17fecd6102fd76452ad4042f7b0

uk.ansonng.us Open in urlscan Pro 2606:4700:3033::ac43:d7bc Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

13 Requests

85 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

137 kBTransfer

356 kBSize

1 Cookies

2 Outgoing links

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

1 Cookies

2 Console Messages

Security Headers

Indicators

uk.ansonng.us Open in urlscan Pro
2606:4700:3033::ac43:d7bc Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

85 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

137 kB
Transfer

356 kB
Size

1
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!