connectcharity.co.uk

Summary

This website contacted 2 IPs in 1 countries across 3 domains to perform 6 HTTP transactions. The main IP is 2606:4700:30::6818:6524, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is connectcharity.co.uk.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on September 24th 2019. Valid for: a year.

This is the only time connectcharity.co.uk was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 1	3.224.64.134 3.224.64.134	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
5	2606:4700:30:... 2606:4700:30::6818:6524	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	2606:4700::68... 2606:4700::6811:4004	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
6	2

1 3.224.64.134 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-3-224-64-134.compute-1.amazonaws.com

rebrand.ly	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700:30::6818:6524 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

connectcharity.co.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:4004 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

ajax.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	connectcharity.co.uk connectcharity.co.uk	329 KB
1	cloudflare.com ajax.cloudflare.com	4 KB
1	rebrand.ly 1 redirects rebrand.ly	289 B
6	3

	Domain	Requested by
5	connectcharity.co.uk	connectcharity.co.uk ajax.cloudflare.com
1	ajax.cloudflare.com	connectcharity.co.uk
1	rebrand.ly	1 redirects
6	3

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2019-09-24` - `2020-09-23`	a year	crt.sh
cloudflare.com CloudFlare Inc ECC CA-2	`2020-01-07` - `2020-10-09`	9 months	crt.sh

This page contains 1 frames:

Primary Page: https://connectcharity.co.uk/File%20/access/vendorfiles/cloud.attached.php
Frame ID: 84AC2127AA6A7275BC7D9B700ED637E8
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://rebrand.ly/75edbn HTTP 301
https://connectcharity.co.uk/File%20/access/vendorfiles/cloud.attached.php Page URL

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

6
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

333 kB
Transfer

408 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://rebrand.ly/75edbn HTTP 301
https://connectcharity.co.uk/File%20/access/vendorfiles/cloud.attached.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request cloud.attached.php Show response
connectcharity.co.uk/File%20/access/vendorfiles/
Redirect Chain

http://rebrand.ly/75edbn
https://connectcharity.co.uk/File%20/access/vendorfiles/cloud.attached.php

3 KB
1 KB

282ms
122ms

Document
text/html

2606:4700:30::6818:6524
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://connectcharity.co.uk/File%20/access/vendorfiles/cloud.attached.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6818:6524 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: add4a3bb42f12d7694205b66f0f0c899f6b486fc5c5e741110fb37c849453962

Request headers

:method: GET
:authority: connectcharity.co.uk
:scheme: https
:path: /File%20/access/vendorfiles/cloud.attached.php
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: none
sec-fetch-mode: navigate
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

status: 200
date: Fri, 10 Jan 2020 09:10:06 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=ded869f667d96581493f0733e881b1f401578647406; expires=Sun, 09-Feb-20 09:10:06 GMT; path=/; domain=.connectcharity.co.uk; HttpOnly; SameSite=Lax
vary: Accept-Encoding,User-Agent
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 552d84121dcbd6cd-FRA
content-encoding: br

Redirect headers

Cache-Control: no-cache, no-store
Date: Fri, 10 Jan 2020 09:10:06 GMT
Engine: Rebrandly.redirect, version 2.0
Expires: -1
Location: https://connectcharity.co.uk/File%20/access/vendorfiles/cloud.attached.php
Content-Length: 0
Connection: keep-alive

GET
H2 200 style.css
connectcharity.co.uk/File%20/access/vendorfiles/ 6 KB
2 KB 58ms
58ms Stylesheet
text/css 2606:4700:30::6818:6524
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://connectcharity.co.uk/File%20/access/vendorfiles/style.css
Requested by: Host: connectcharity.co.uk
URL: https://connectcharity.co.uk/File%20/access/vendorfiles/cloud.attached.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6818:6524 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: f3a3435dd1e14ea7ec192be880befce0c60c18a1dd6161f3a66cb82e9b358002

Request headers

Referer: https://connectcharity.co.uk/File%20/access/vendorfiles/cloud.attached.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Fri, 10 Jan 2020 09:10:06 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Sat, 15 Dec 2018 18:09:32 GMT
server: cloudflare
etag: W/"1778-57d1373128f00-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
content-type: text/css
status: 200
cache-control: max-age=2678400
cf-ray: 552d8412e853d6cd-FRA

GET
H2 200 ms-logo-v2.jpg
connectcharity.co.uk/File%20/access/vendorfiles/images/ 3 KB
3 KB 67ms
67ms Image
image/jpeg 2606:4700:30::6818:6524
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://connectcharity.co.uk/File%20/access/vendorfiles/images/ms-logo-v2.jpg
Requested by: Host: connectcharity.co.uk
URL: https://connectcharity.co.uk/File%20/access/vendorfiles/cloud.attached.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6818:6524 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: bc2b16b51738b77d94ed7591ad1033fa804297ca9faaa35222aa65773f749164

Request headers

Referer: https://connectcharity.co.uk/File%20/access/vendorfiles/cloud.attached.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Fri, 10 Jan 2020 09:10:06 GMT
cf-cache-status: REVALIDATED
last-modified: Sat, 15 Dec 2018 18:09:32 GMT
server: cloudflare
etag: "aed-57d1373128f00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 552d8412e856d6cd-FRA
content-length: 2797

GET
H2 200 rocket-loader.min.js Show response
ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/ 12 KB
4 KB 8ms
8ms Script
application/javascript 2606:4700::6811:4004
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js

Requested by

Host: connectcharity.co.uk
URL: https://connectcharity.co.uk/File%20/access/vendorfiles/cloud.attached.php

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:4004 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

b08cdbc2d30e656a86b20f8342428d5863f70f4b30135b4f4061f754ce932f5e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://connectcharity.co.uk/File%20/access/vendorfiles/cloud.attached.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Fri, 10 Jan 2020 09:10:06 GMT
content-encoding: gzip
last-modified: Wed, 08 Jan 2020 13:55:30 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"5e15df52-3016"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=172800, public
strict-transport-security: max-age=15780000; includeSubDomains
cf-ray: 552d8412ebdd6413-FRA
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
expires: Sun, 12 Jan 2020 09:10:06 GMT

GET
H2 200 jquery.js Show response
connectcharity.co.uk/File%20/access/vendorfiles/js/ 94 KB
32 KB 95ms
95ms Script
application/javascript 2606:4700:30::6818:6524
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://connectcharity.co.uk/File%20/access/vendorfiles/js/jquery.js
Requested by: Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6818:6524 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 91222f96f34735ebc88df208017e54d4329b9202e3e52367fb8b149698a1a5ef

Request headers

Referer: https://connectcharity.co.uk/File%20/access/vendorfiles/cloud.attached.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Fri, 10 Jan 2020 09:10:06 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Sat, 15 Dec 2018 18:09:32 GMT
server: cloudflare
etag: W/"1762e-57d1373128f00-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
status: 200
cache-control: max-age=2678400
cf-ray: 552d8412f8a1d6cd-FRA

GET
H2 200 0.jpg
connectcharity.co.uk/File%20/access/vendorfiles/images/ 291 KB
292 KB 52ms
52ms Image
image/jpeg 2606:4700:30::6818:6524
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://connectcharity.co.uk/File%20/access/vendorfiles/images/0.jpg
Requested by: Host: connectcharity.co.uk
URL: https://connectcharity.co.uk/File%20/access/vendorfiles/cloud.attached.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6818:6524 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 62faab60433070e2ea52c235f0f18db228759f2a08bb6f9e5711630df8321214

Request headers

Referer: https://connectcharity.co.uk/File%20/access/vendorfiles/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Fri, 10 Jan 2020 09:10:06 GMT
cf-cache-status: REVALIDATED
last-modified: Sat, 15 Dec 2018 18:09:32 GMT
server: cloudflare
etag: "48c79-57d1373128f00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 552d841349a1d6cd-FRA
content-length: 298105

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.connectcharity.co.uk/	1970-01-19 07:13:59	Name: __cfduid Value: ded869f667d96581493f0733e881b1f401578647406

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.cloudflare.com
connectcharity.co.uk
rebrand.ly
2606:4700:30::6818:6524
2606:4700::6811:4004
3.224.64.134
62faab60433070e2ea52c235f0f18db228759f2a08bb6f9e5711630df8321214
91222f96f34735ebc88df208017e54d4329b9202e3e52367fb8b149698a1a5ef
add4a3bb42f12d7694205b66f0f0c899f6b486fc5c5e741110fb37c849453962
b08cdbc2d30e656a86b20f8342428d5863f70f4b30135b4f4061f754ce932f5e
bc2b16b51738b77d94ed7591ad1033fa804297ca9faaa35222aa65773f749164
f3a3435dd1e14ea7ec192be880befce0c60c18a1dd6161f3a66cb82e9b358002

connectcharity.co.uk Open in urlscan Pro 2606:4700:30::6818:6524 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

2 IPs

1 Countries

333 kBTransfer

408 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

1 Cookies

Indicators

connectcharity.co.uk Open in urlscan Pro
2606:4700:30::6818:6524 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

333 kB
Transfer

408 kB
Size

1
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!