vmi558659.contaboserver.net
Open in
urlscan Pro
161.97.140.120
Malicious Activity!
Public Scan
Submitted URL: https://c777-02.andaina.net/?rq=SY3Zfx6FmbUS3PWaFs
Effective URL: https://vmi558659.contaboserver.net/doc/app/188552630254751.php?TokenID=OfKmgrhszWUhvtPiq
Submission: On April 06 via manual from GB
Effective URL: https://vmi558659.contaboserver.net/doc/app/188552630254751.php?TokenID=OfKmgrhszWUhvtPiq
Submission: On April 06 via manual from GB
Summary
This website contacted 1 IPs
in 2 countries
across 2 domains to perform 8 HTTP transactions.
The main IP is 161.97.140.120, located in
Düsseldorf, Germany and
belongs to CONTABO, DE.
The main domain is vmi558659.contaboserver.net.
TLS certificate: Issued by cPanel, Inc. Certification Authority on April 1st 2021. Valid for: a year.
This is the only time vmi558659.contaboserver.net was scanned on urlscan.io!
TLS certificate: Issued by cPanel, Inc. Certification Authority on April 1st 2021. Valid for: a year.
This is the only time vmi558659.contaboserver.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: UK Government (Government)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 1 | 185.140.32.149 185.140.32.149 | 203280 (ANDAINA) (ANDAINA) | |
| 3 11 | 161.97.140.120 161.97.140.120 | 51167 (CONTABO) (CONTABO) | |
| 8 | 1 |
11
161.97.140.120
(Düsseldorf, Germany)
ASN51167 (CONTABO, DE)
PTR: vmi558659.contaboserver.net
ASN51167 (CONTABO, DE)
PTR: vmi558659.contaboserver.net
| vmi558659.contaboserver.net |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 11 |
contaboserver.net
3 redirects
vmi558659.contaboserver.net |
81 KB |
| 1 |
andaina.net
1 redirects
c777-02.andaina.net |
263 B |
| 8 | 2 |
| Domain | Requested by | |
|---|---|---|
| 11 | vmi558659.contaboserver.net |
3 redirects
vmi558659.contaboserver.net
|
| 1 | c777-02.andaina.net | 1 redirects |
| 8 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| vehicleenquiry.service.gov.uk |
| www.gov.uk |
| dvladigital.blog.gov.uk |
| www.nationalarchives.gov.uk |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| vmi558659.contaboserver.net cPanel, Inc. Certification Authority |
2021-04-01 - 2022-04-01 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://vmi558659.contaboserver.net/doc/app/188552630254751.php?TokenID=OfKmgrhszWUhvtPiq
Frame ID: A26B2C9FF7F84CD24641FB64661DA867
Requests: 8 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://c777-02.andaina.net/?rq=SY3Zfx6FmbUS3PWaFs
HTTP 302
https://vmi558659.contaboserver.net/doc/ HTTP 302
https://vmi558659.contaboserver.net/doc/app HTTP 301
https://vmi558659.contaboserver.net/doc/app/ HTTP 302
https://vmi558659.contaboserver.net/doc/app/188552630254751.php?TokenID=OfKmgrhszWUhvtPiq Page URL
Detected technologies
Ruby
(Programming Languages)
Expand
Overall confidence: 50%
Detected patterns
Detected patterns
- meta csrf-param /^authenticity_token$/i
Ruby on Rails
(Web Frameworks)
Expand
Overall confidence: 50%
Detected patterns
Detected patterns
- meta csrf-param /^authenticity_token$/i
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
10 Outgoing links
These are links going to different origins than the main page.
URL: https://vehicleenquiry.service.gov.uk/?_ga=2.265269455.1314471023.1598869990-230327214.1598869990#main-content
Title: Skip to main content
Title: Skip to main content
Search URL Search Domain Scan URL
URL: https://www.gov.uk/
Title: GOV.UK
Title: GOV.UK
Search URL Search Domain Scan URL
URL: https://vehicleenquiry.service.gov.uk/?locale=en
Title: Vehicle Tax Application
Title: Vehicle Tax Application
Search URL Search Domain Scan URL
URL: https://vehicleenquiry.service.gov.uk/Cookies?locale=en
Title: Cookies
Title: Cookies
Search URL Search Domain Scan URL
URL: https://vehicleenquiry.service.gov.uk/TermsAndConditions?locale=en
Title: Terms and Conditions
Title: Terms and Conditions
Search URL Search Domain Scan URL
URL: https://vehicleenquiry.service.gov.uk/?locale=cy
Title: Cymraeg
Title: Cymraeg
Search URL Search Domain Scan URL
URL: https://www.gov.uk/government/publications/dvla-privacy-policy
Title: Privacy Information Notice
Title: Privacy Information Notice
Search URL Search Domain Scan URL
URL: https://dvladigital.blog.gov.uk/
Title: Driver & Vehicle Licensing Agency
Title: Driver & Vehicle Licensing Agency
Search URL Search Domain Scan URL
URL: https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/
Title:
Title:
Search URL Search Domain Scan URL
URL: http://www.nationalarchives.gov.uk/information-management/re-using-public-sector-information/copyright-and-re-use/crown-copyright/
Title: @ Crown copyright
Title: @ Crown copyright
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://c777-02.andaina.net/?rq=SY3Zfx6FmbUS3PWaFs
HTTP 302
https://vmi558659.contaboserver.net/doc/ HTTP 302
https://vmi558659.contaboserver.net/doc/app HTTP 301
https://vmi558659.contaboserver.net/doc/app/ HTTP 302
https://vmi558659.contaboserver.net/doc/app/188552630254751.php?TokenID=OfKmgrhszWUhvtPiq Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
 Cookie set
188552630254751.php
vmi558659.contaboserver.net/doc/app/ Redirect Chain
|
10 KB 10 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
application-edbf15f9.css
vmi558659.contaboserver.net/doc/app/includes/ |
93 KB 12 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
application-5f3eeb9f79e61d1b297c.js.download
vmi558659.contaboserver.net/doc/app/includes/ |
187 KB 57 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
light-94a07e06a1-v2.woff2
vmi558659.contaboserver.net/packs/assets/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
govuk-crest.png
vmi558659.contaboserver.net/packs/assets/images/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bold-b542beb274-v2.woff2
vmi558659.contaboserver.net/packs/assets/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
light-f591b13f7d-v2.woff
vmi558659.contaboserver.net/packs/assets/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bold-affa96571d-v2.woff
vmi558659.contaboserver.net/packs/assets/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: UK Government (Government)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| uQUWLTxlTSIzXKQa object| ReactRailsUJS1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| vmi558659.contaboserver.net/ | Name: PHPSESSID Value: 2c8efc4ac3575ddb2773ffa90bffcdf8 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
c777-02.andaina.net
vmi558659.contaboserver.net
161.97.140.120
185.140.32.149
4b194f7071877dbd9e2477bb7e5e688b659638f4ebe7377edda626bcb9467fdf
6673bcbf6444fb7d0931f15f7d74612e6adb2322d045c1d638a82656502921b4
b1e6ddd88468defbccb72a14d8f8d9b62d4976161ac25d2262966dca655d0fb9
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3