zfwd.co.uk
Open in
urlscan Pro
2a07:7800::185
Malicious Activity!
Public Scan
Effective URL: https://zfwd.co.uk/
Submission: On May 31 via api from US — Scanned from GB
Summary
TLS certificate: Issued by R3 on May 4th 2024. Valid for: 3 months.
This is the only time zfwd.co.uk was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Steam (Gaming)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
10 | 2a07:7800::185 2a07:7800::185 | 48254 (TWENTYI) (TWENTYI) | |
1 | 2a00:1450:400... 2a00:1450:4001:812::200a | 15169 (GOOGLE) (GOOGLE) | |
5 | 104.17.24.14 104.17.24.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2.17.147.72 2.17.147.72 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 2a04:4e42::649 2a04:4e42::649 | 54113 (FASTLY) (FASTLY) | |
1 | 104.18.10.207 104.18.10.207 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:810::2003 | 15169 (GOOGLE) (GOOGLE) | |
21 | 8 |
ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-17-147-72.deploy.static.akamaitechnologies.com
store.akamai.steamstatic.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
zfwd.co.uk
zfwd.co.uk |
5 MB |
5 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 237 |
130 KB |
1 |
gstatic.com
fonts.gstatic.com |
30 KB |
1 |
bootstrapcdn.com
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 3044 |
17 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 776 |
24 KB |
1 |
steamstatic.com
store.akamai.steamstatic.com — Cisco Umbrella Rank: 19114 |
2 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 33 |
913 B |
21 | 7 |
Domain | Requested by | |
---|---|---|
10 | zfwd.co.uk |
zfwd.co.uk
|
5 | cdnjs.cloudflare.com |
zfwd.co.uk
cdnjs.cloudflare.com |
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | stackpath.bootstrapcdn.com |
zfwd.co.uk
|
1 | code.jquery.com |
zfwd.co.uk
|
1 | store.akamai.steamstatic.com |
zfwd.co.uk
|
1 | fonts.googleapis.com |
zfwd.co.uk
|
21 | 7 |
This site contains links to these domains. Also see Links.
Domain |
---|
discord.gg |
store.steampowered.com |
www.instagram.com |
www.youtube.com |
www.twitch.tv |
www.deviantart.com |
markmozza.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.zfwd.co.uk R3 |
2024-05-04 - 2024-08-02 |
3 months | crt.sh |
upload.video.google.com WR2 |
2024-05-13 - 2024-08-05 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-07-03 - 2024-07-02 |
a year | crt.sh |
cdn.akamai.steamstatic.com R3 |
2024-04-04 - 2024-07-03 |
3 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
bootstrapcdn.com GTS CA 1P5 |
2024-05-25 - 2024-08-23 |
3 months | crt.sh |
*.gstatic.com WR2 |
2024-05-13 - 2024-08-05 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://zfwd.co.uk/
Frame ID: 5F778EFA34C4428FD31606632E666670
Requests: 21 HTTP requests in this frame
Screenshot
Page Title
ZForwardPage URL History Show full URLs
-
http://zfwd.co.uk/
HTTP 307
https://zfwd.co.uk/ Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Google Font API (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Highlight.js (Miscellaneous) Expand
Detected patterns
- /(?:([\d.])+/)?highlight(?:\.min)?\.js
Popper (Miscellaneous) Expand
Detected patterns
- <script [^>]*src="[^"]*/popper\.js/([0-9.]+)
- /popper\.js/([0-9.]+)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
13 Outgoing links
These are links going to different origins than the main page.
Title: Support
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: Humanoid Basics
Search URL Search Domain Scan URL
Title: Ultimate Parallax
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://zfwd.co.uk/
HTTP 307
https://zfwd.co.uk/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 19- https://zfwd.co.uk/cms-content/assets/images/fav-icon.png HTTP 0
- http://zfwd.co.uk/cms-content/assets/images/fav-icon.png/
21 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
zfwd.co.uk/ Redirect Chain
|
14 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
3 KB 913 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
zfwd.co.uk/cms-content/assets/css/ |
208 KB 39 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.1/css/ |
58 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
default.min.css
cdnjs.cloudflare.com/ajax/libs/highlight.js/10.7.2/styles/ |
763 B 852 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
highlight.min.js
cdnjs.cloudflare.com/ajax/libs/highlight.js/10.7.2/ |
132 KB 34 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
zforward_small_trans.png
zfwd.co.uk/cms-content/assets/images/ |
22 KB 22 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
zforward_small_256.png
zfwd.co.uk/cms-content/assets/images/ |
16 KB 16 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
visit.png
zfwd.co.uk/cms-content/assets/images/ |
33 KB 34 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo_steam.svg
store.akamai.steamstatic.com/public/shared/images/header/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
markmozza.jpg
zfwd.co.uk/cms-content/assets/images/ |
279 KB 279 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dave.jpg
zfwd.co.uk/cms-content/assets/images/ |
21 KB 21 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lauran.jpg
zfwd.co.uk/cms-content/assets/images/ |
2 MB 2 MB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
raiden.png
zfwd.co.uk/cms-content/assets/images/ |
788 KB 789 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fuse.png
zfwd.co.uk/cms-content/assets/images/ |
2 MB 2 MB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.3.1.slim.min.js
code.jquery.com/ |
68 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.7/umd/ |
21 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.5.0/js/ |
59 KB 17 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
HhyaU5sn9vOmLzloC_U.woff2
fonts.gstatic.com/s/dosis/v32/ |
30 KB 30 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
fa-brands-400.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.1/webfonts/ |
77 KB 77 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
/
zfwd.co.uk/cms-content/assets/images/fav-icon.png/ Redirect Chain
|
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- zfwd.co.uk
- URL
- http://zfwd.co.uk/cms-content/assets/images/fav-icon.png/
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Steam (Gaming)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| hljs function| $ function| jQuery function| Popper object| bootstrap1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.zfwd.co.uk/ | Name: mmc Value: 1114479e3a6292b7e54c82c6a0d8feb8 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
code.jquery.com
fonts.googleapis.com
fonts.gstatic.com
stackpath.bootstrapcdn.com
store.akamai.steamstatic.com
zfwd.co.uk
zfwd.co.uk
104.17.24.14
104.18.10.207
2.17.147.72
2a00:1450:4001:810::2003
2a00:1450:4001:812::200a
2a04:4e42::649
2a07:7800::185
0dcac7cabd17a67b5d09d54d506c6ed734516248e9e8552d194b1a5cf16b7722
2a3d813d7a239b7096db0c5b78f53c7863212b42843041ea58b1ecadfbdc8439
2a4e905badd778742d19d403322cc972be4252d5330e067f8a03181a46ca8e10
38544024da1a0fc2f706be6582557b5722d17f48ad9a8073594a0cf928e2e3ff
54f7e4e5ba649e1aa23ba08c30c4c74195954428c93a6c038f2b6653bcb189f9
66f3a07e1fa9b64a686b66381e4458dbc8abf3dbbff954720c4eec07b84411c2
71b3ce72680f4183d28db86b184542051fd533bb1146933233e4f6a20cf98cba
7c3bb686cf87c692323c53cdc32528edc686417d44700afd32888b39349f18c5
8a969e8a005990627c277dbcbc8e08b192c56d6306060030916172ce5e442271
9c7fadf0c0eeb47b8055151e292ccbc8bd7a4f523dba81920ec6f978672ab6df
a5b728a11b0b6c29bb64101d0962d6a7cb2f7c9f118efff0469a628f2105a69d
af1e6edc875a382b338bb25bd7c5c3f474a7f1b36212002a5896dd06f2186325
b9be205e4d4ac7901076a803f93790fd8c8b92d1fdc0e8f18178f724cfd9f6a4
c081f36e29ad8a29fe0ad534af831ad3359245a5db111e7d55aa963036350313
c3a7c646a1305017f22423030cb5a12acc9f96b64013dcef7aeb80567b542cbb
c4810aef4959ce0da5acf733ebba5f25f47d4dd0cae1d6eb4441ccb20e35eca7
dd8367e55ed4507869f57c4ef5a44401fc6e8dd0f401107435f855d95ec6a9e9
dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1
e361dd8aad6e06b7b799f6d7ec14edd1096ef123d047ce67ecaa3ad05f3ad5d4
e3cc36c64ef86bed21592653daac82fd7e4c364c32c8344336aa13f7dbf52c90