www.carepath-recruitment.co.uk Open in urlscan Pro
92.205.13.202 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://www.carepath-recruitment.co.uk/home/payment.php
Submission Tags: falconsandbox
Submission: On October 16 via api (October 16th 2022, 8:03:39 pm UTC) from US — Scanned from FR

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 10 HTTP transactions. The main IP is 92.205.13.202, located in Strasbourg, France and belongs to GODADDY-SXB, DE. The main domain is www.carepath-recruitment.co.uk.

This is the only time www.carepath-recruitment.co.uk was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online) Netflix (Online)

Domain & IP information

	IP Address	AS Autonomous System
4	92.205.13.202 92.205.13.202	21499 (GODADDY-SXB) (GODADDY-SXB)
6	2a00:86c0:209... 2a00:86c0:2090::1	40027 (NETFLIX-ASN) (NETFLIX-ASN)
10	2

4 92.205.13.202 (Strasbourg, France)

ASN21499 (GODADDY-SXB, DE)
PTR: 202.13.205.92.host.secureserver.net

www.carepath-recruitment.co.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:86c0:2090::1 (United States)

ASN40027 (NETFLIX-ASN, US)

assets.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	nflxext.com assets.nflxext.com — Cisco Umbrella Rank: 4881	84 KB
4	carepath-recruitment.co.uk www.carepath-recruitment.co.uk	37 KB
10	2

	Domain	Requested by
6	assets.nflxext.com	www.carepath-recruitment.co.uk
4	www.carepath-recruitment.co.uk	www.carepath-recruitment.co.uk
10	2

This site contains no links.

Subject Issuer	Validity	Valid
*.1.nflxso.net DigiCert TLS RSA SHA256 2020 CA1	`2022-10-14` - `2022-11-15`	a month	crt.sh

This page contains 1 frames:

Primary Page: http://www.carepath-recruitment.co.uk/home/payment.php
Frame ID: CEDB5C3B4D4FE8B197C60483AC23C604
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Netflix - Payment Information

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

React (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+data-react

Page Statistics

10
Requests

60 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

120 kB
Transfer

210 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request payment.php Show response www.carepath-recruitment.co.uk/home/	17 KB 13 KB	185ms 122ms	Document text/html	92.205.13.202 GODADDY-SXB
General Check archive.org Show headers Download Go to Full URL http://www.carepath-recruitment.co.uk/home/payment.php Protocol HTTP/1.1 Server 92.205.13.202 Strasbourg, France, ASN21499 (GODADDY-SXB, DE), Reverse DNS 202.13.205.92.host.secureserver.net Software Apache / PHP/7.4.32 Resource Hash `d3587ed71de70f954d4c9e1e77c05bbe5e9e146dcbb6aff881a508d04b1b4ec4` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 accept-language fr-FR,fr;q=0.9 Response headers Connection Upgrade, Keep-Alive Content-Encoding gzip Content-Length 13424 Content-Type text/html; charset=UTF-8 Date Sun, 16 Oct 2022 20:03:35 GMT Keep-Alive timeout=5 Server Apache Upgrade h2,h2c Vary Accept-Encoding X-Powered-By PHP/7.4.32
GET H/1.1	200 OK	hok.js Show response www.carepath-recruitment.co.uk/home/	20 KB 6 KB	49ms 27ms	Script application/javascript	92.205.13.202 GODADDY-SXB
General Check archive.org Show headers Download Go to Full URL http://www.carepath-recruitment.co.uk/home/hok.js Requested by Host: www.carepath-recruitment.co.uk URL: http://www.carepath-recruitment.co.uk/home/payment.php Protocol HTTP/1.1 Server 92.205.13.202 Strasbourg, France, ASN21499 (GODADDY-SXB, DE), Reverse DNS 202.13.205.92.host.secureserver.net Software Apache / Resource Hash `847c86ae982abe9180233276125b930b4a1b6f1bd12649b0c07535c1e984def8` Request headers accept-language fr-FR,fr;q=0.9 Referer http://www.carepath-recruitment.co.uk/home/payment.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Date Sun, 16 Oct 2022 20:03:35 GMT Content-Encoding gzip Last-Modified Sun, 26 Mar 2017 20:08:38 GMT Server Apache ETag "41c1821-4f65-54ba7cad2fd80-gzip" Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5 Content-Length 6049
GET H/1.1	200 OK	b.css www.carepath-recruitment.co.uk/home/css/	47 KB 9 KB	29ms 29ms	Stylesheet text/css	92.205.13.202 GODADDY-SXB
General Check archive.org Show headers Download Go to Full URL http://www.carepath-recruitment.co.uk/home/css/b.css Requested by Host: www.carepath-recruitment.co.uk URL: http://www.carepath-recruitment.co.uk/home/payment.php Protocol HTTP/1.1 Server 92.205.13.202 Strasbourg, France, ASN21499 (GODADDY-SXB, DE), Reverse DNS 202.13.205.92.host.secureserver.net Software Apache / Resource Hash `698b6be2d6d9c0302d13ff00cd503fd93c5a8ea57060626fefa013375efeb2ae` Request headers accept-language fr-FR,fr;q=0.9 Referer http://www.carepath-recruitment.co.uk/home/payment.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Date Sun, 16 Oct 2022 20:03:35 GMT Content-Encoding gzip Last-Modified Sun, 26 Mar 2017 19:21:12 GMT Server Apache ETag "41c1827-baa2-54ba721307a00-gzip" Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5 Content-Length 8617
GET H/1.1	200 OK	c.css www.carepath-recruitment.co.uk/home/css/	45 KB 8 KB	28ms 28ms	Stylesheet text/css	92.205.13.202 GODADDY-SXB
General Check archive.org Show headers Download Go to Full URL http://www.carepath-recruitment.co.uk/home/css/c.css Requested by Host: www.carepath-recruitment.co.uk URL: http://www.carepath-recruitment.co.uk/home/payment.php Protocol HTTP/1.1 Server 92.205.13.202 Strasbourg, France, ASN21499 (GODADDY-SXB, DE), Reverse DNS 202.13.205.92.host.secureserver.net Software Apache / Resource Hash `1f24e58ff9d53d36818697d994c3fc7e3c4fb7191d5769c3c74fde80b72637a1` Request headers accept-language fr-FR,fr;q=0.9 Referer http://www.carepath-recruitment.co.uk/home/payment.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Date Sun, 16 Oct 2022 20:03:35 GMT Content-Encoding gzip Last-Modified Sun, 26 Mar 2017 19:21:10 GMT Server Apache ETag "41c1825-b403-54ba72111f580-gzip" Vary Accept-Encoding Upgrade h2,h2c Content-Type text/css Connection Upgrade, Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5 Content-Length 8013
GET H/1.1	200 OK	question_mark.png assets.nflxext.com/us/layout/ecweb/common/	564 B 942 B	91ms 18ms	Image image/png	2a00:86c0:2090::1 NETFLIX-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://assets.nflxext.com/us/layout/ecweb/common/question_mark.png Requested by Host: www.carepath-recruitment.co.uk URL: http://www.carepath-recruitment.co.uk/home/payment.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US), Reverse DNS Software nginx / Resource Hash `973576ba6483c6c75d1d55339c1cac5d742abef700ede0903341ab222a2ee7c2` Request headers accept-language fr-FR,fr;q=0.9 Referer http://www.carepath-recruitment.co.uk/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Date Sun, 16 Oct 2022 20:03:35 GMT Last-Modified Wed, 03 Aug 2022 23:50:14 GMT Server nginx Content-MD5 vAt5EcRRSHeewQiseaAvUA== ETag "bc0b7911c45148779ec108ac79a02f50:1659571872.218909" Content-Type image/png Cache-Control max-age=14401 Connection keep-alive Accept-Ranges bytes Content-Length 564 Expires Mon, 17 Oct 2022 00:03:36 GMT
GET H/1.1	200 OK	carrot_sprite_16x33.png assets.nflxext.com/en_us/layout/ecweb/common/	1 KB 2 KB	63ms 22ms	Image image/png	2a00:86c0:2090::1 NETFLIX-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://assets.nflxext.com/en_us/layout/ecweb/common/carrot_sprite_16x33.png Requested by Host: www.carepath-recruitment.co.uk URL: http://www.carepath-recruitment.co.uk/home/css/c.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US), Reverse DNS Software nginx / Resource Hash `a47661d7ad003fe7df9ac30d1ce3b984dd9186b676f77b41e0d53f2f4ce4ac8b` Request headers accept-language fr-FR,fr;q=0.9 Referer http://www.carepath-recruitment.co.uk/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Date Sun, 16 Oct 2022 20:03:35 GMT Last-Modified Wed, 03 Aug 2022 23:50:13 GMT Server nginx Content-MD5 S5zo1aDe9OUlKAAcIeVx8w== ETag "4b9ce8d5a0def4e52528001c21e571f3:1659571859.757604" Content-Type image/png Cache-Control max-age=14401 Connection keep-alive Accept-Ranges bytes Content-Length 1449 Expires Mon, 17 Oct 2022 00:03:36 GMT
GET H/1.1	200 OK	12_11_2014_icon_visa_37x25.png assets.nflxext.com/ffe/siteui/acquisition/payment/	859 B 1 KB	84ms 38ms	Image image/png	2a00:86c0:2090::1 NETFLIX-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://assets.nflxext.com/ffe/siteui/acquisition/payment/12_11_2014_icon_visa_37x25.png Requested by Host: www.carepath-recruitment.co.uk URL: http://www.carepath-recruitment.co.uk/home/css/c.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US), Reverse DNS Software nginx / Resource Hash `7ed65da4bcdc5f0f68d20f2b489f2f1e4df6d5b1235ece01afd24624126be504` Request headers accept-language fr-FR,fr;q=0.9 Referer http://www.carepath-recruitment.co.uk/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Date Sun, 16 Oct 2022 20:03:35 GMT Last-Modified Wed, 10 Jul 2019 23:52:28 GMT Server nginx Content-MD5 InDyhjoqaXrupmtM5xGKHA== Content-Type image/png Cache-Control max-age=604801 Connection keep-alive Accept-Ranges bytes Content-Length 859 Expires Sun, 23 Oct 2022 20:03:36 GMT
GET H/1.1	200 OK	10_18_2014_icon_master_37x25.png assets.nflxext.com/ffe/siteui/acquisition/payment/	833 B 1 KB	249ms 185ms	Image image/png	2a00:86c0:2090::1 NETFLIX-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://assets.nflxext.com/ffe/siteui/acquisition/payment/10_18_2014_icon_master_37x25.png Requested by Host: www.carepath-recruitment.co.uk URL: http://www.carepath-recruitment.co.uk/home/css/c.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US), Reverse DNS Software nginx / Resource Hash `4958e4d47607004834b13d3c29d91f8c15b2ab2c488a15d9745a039e970f0bf3` Request headers accept-language fr-FR,fr;q=0.9 Referer http://www.carepath-recruitment.co.uk/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Date Sun, 16 Oct 2022 20:03:35 GMT Last-Modified Wed, 10 Jul 2019 23:52:28 GMT Server nginx Content-MD5 xwSU1ALetVNBhYpdQPEPWw== Content-Type image/png Cache-Control max-age=604801 Connection keep-alive Accept-Ranges bytes Content-Length 833 Expires Sun, 23 Oct 2022 20:03:36 GMT
GET H/1.1	200 OK	10_18_2014_icon_amex_37x25.png assets.nflxext.com/ffe/siteui/acquisition/payment/	525 B 844 B	83ms 18ms	Image image/png	2a00:86c0:2090::1 NETFLIX-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://assets.nflxext.com/ffe/siteui/acquisition/payment/10_18_2014_icon_amex_37x25.png Requested by Host: www.carepath-recruitment.co.uk URL: http://www.carepath-recruitment.co.uk/home/css/c.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US), Reverse DNS Software nginx / Resource Hash `cc5859d74f8cde62e1cdeeea341f85f9725d4f4398f58203aa1e5080faf1685a` Request headers accept-language fr-FR,fr;q=0.9 Referer http://www.carepath-recruitment.co.uk/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Date Sun, 16 Oct 2022 20:03:35 GMT Last-Modified Wed, 10 Jul 2019 23:52:28 GMT Server nginx Content-MD5 XUIHbO4+/oKKw/K3EvF4SA== Content-Type image/png Cache-Control max-age=604801 Connection keep-alive Accept-Ranges bytes Content-Length 525 Expires Sun, 23 Oct 2022 20:03:36 GMT
GET H/1.1	200 OK	nf-icon-v1-80.woff assets.nflxext.com/ffe/siteui/fonts/	78 KB 78 KB	59ms 21ms	Font font/woff	2a00:86c0:2090::1 NETFLIX-ASN
General Check archive.org Show headers Download Go to Full URL https://assets.nflxext.com/ffe/siteui/fonts/nf-icon-v1-80.woff Requested by Host: www.carepath-recruitment.co.uk URL: http://www.carepath-recruitment.co.uk/home/css/b.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US), Reverse DNS Software nginx / Resource Hash `2555364bdd6374d0c273c69322f2f78554c02fe630ee6582eeb2d2c9031d1a9d` Request headers Referer http://www.carepath-recruitment.co.uk/ Origin http://www.carepath-recruitment.co.uk accept-language fr-FR,fr;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Date Sun, 16 Oct 2022 20:03:35 GMT Last-Modified Thu, 28 Jan 2016 20:46:04 GMT Server nginx Content-MD5 GkWpE2r/FESZk08OjSTsgQ== Content-Type font/woff Access-Control-Allow-Origin * Cache-Control max-age=604801 Connection keep-alive Accept-Ranges bytes Content-Length 79392 Expires Sun, 23 Oct 2022 20:03:36 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online) Netflix (Online)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.nflxext.com
www.carepath-recruitment.co.uk
2a00:86c0:2090::1
92.205.13.202
1f24e58ff9d53d36818697d994c3fc7e3c4fb7191d5769c3c74fde80b72637a1
2555364bdd6374d0c273c69322f2f78554c02fe630ee6582eeb2d2c9031d1a9d
4958e4d47607004834b13d3c29d91f8c15b2ab2c488a15d9745a039e970f0bf3
698b6be2d6d9c0302d13ff00cd503fd93c5a8ea57060626fefa013375efeb2ae
7ed65da4bcdc5f0f68d20f2b489f2f1e4df6d5b1235ece01afd24624126be504
847c86ae982abe9180233276125b930b4a1b6f1bd12649b0c07535c1e984def8
973576ba6483c6c75d1d55339c1cac5d742abef700ede0903341ab222a2ee7c2
a47661d7ad003fe7df9ac30d1ce3b984dd9186b676f77b41e0d53f2f4ce4ac8b
cc5859d74f8cde62e1cdeeea341f85f9725d4f4398f58203aa1e5080faf1685a
d3587ed71de70f954d4c9e1e77c05bbe5e9e146dcbb6aff881a508d04b1b4ec4

www.carepath-recruitment.co.uk Open in urlscan Pro 92.205.13.202 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

10 Requests

60 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

120 kBTransfer

210 kBSize

0 Cookies

0 Outgoing links

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

14 JavaScript Global Variables

0 Cookies

Indicators

www.carepath-recruitment.co.uk Open in urlscan Pro
92.205.13.202 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

60 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

120 kB
Transfer

210 kB
Size

0
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!