www.govuk.info
Open in
urlscan Pro
2a00:1450:4001:81b::2013
Malicious Activity!
Public Scan
Submission: On November 22 via automatic, source certstream-suspicious
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on November 22nd 2018. Valid for: 3 months.
This is the only time www.govuk.info was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: UK Government (Government)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 2a00:1450:400... 2a00:1450:4001:81b::2013 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 2a00:1450:400... 2a00:1450:4001:81a::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
6 | 2606:4700:30:... 2606:4700:30::681f:5e77 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
11 | 2600:9000:20b... 2600:9000:20bb:d600:15:90c8:9d40:21 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
1 | 2a00:1450:400... 2a00:1450:4001:812::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 2a00:1450:400... 2a00:1450:4001:81a::2003 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
2 | 195.99.215.25 195.99.215.25 | 2856 (BT-UK-AS ...) (BT-UK-AS BTnet UK Regional network) | |
23 | 8 |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
cdn.ucraft.app | |
static.ucraft.app |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
d1dg2mgseur1x.cloudfront.net |
ASN2856 (BT-UK-AS BTnet UK Regional network, GB)
piwik.companieshouse.gov.uk |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
cloudfront.net
d1dg2mgseur1x.cloudfront.net |
533 KB |
6 |
ucraft.app
cdn.ucraft.app static.ucraft.app |
262 KB |
2 |
companieshouse.gov.uk
piwik.companieshouse.gov.uk |
24 KB |
2 |
googleapis.com
fonts.googleapis.com ajax.googleapis.com |
34 KB |
1 |
gstatic.com
fonts.gstatic.com |
9 KB |
1 |
govuk.info
www.govuk.info |
10 KB |
23 | 6 |
Domain | Requested by | |
---|---|---|
11 | d1dg2mgseur1x.cloudfront.net |
www.govuk.info
d1dg2mgseur1x.cloudfront.net |
4 | static.ucraft.app |
www.govuk.info
|
2 | piwik.companieshouse.gov.uk |
www.govuk.info
|
2 | cdn.ucraft.app |
www.govuk.info
|
1 | fonts.gstatic.com |
www.govuk.info
|
1 | ajax.googleapis.com |
www.govuk.info
|
1 | fonts.googleapis.com |
www.govuk.info
|
1 | www.govuk.info | |
23 | 8 |
This site contains links to these domains. Also see Links.
Domain |
---|
follow.companieshouse.gov.uk |
www.gov.uk |
resources.companieshouse.gov.uk |
developer.companieshouse.gov.uk |
www.ucraft.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.govuk.info Let's Encrypt Authority X3 |
2018-11-22 - 2019-02-20 |
3 months | crt.sh |
*.googleapis.com Google Internet Authority G3 |
2018-10-30 - 2019-01-22 |
3 months | crt.sh |
sni34318.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2018-10-28 - 2019-05-06 |
6 months | crt.sh |
*.cloudfront.net DigiCert Global CA G2 |
2018-10-08 - 2019-10-09 |
a year | crt.sh |
*.google.com Google Internet Authority G3 |
2018-10-30 - 2019-01-22 |
3 months | crt.sh |
companieshouse.gov.uk GeoTrust RSA CA 2018 |
2018-04-18 - 2020-04-17 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.govuk.info/
Frame ID: 6BBF9F6426DA68A9BF37D8FF3B62F23C
Requests: 26 HTTP requests in this frame
Screenshot
Detected technologies
Nginx (Web Servers) ExpandDetected patterns
- headers server /nginx(?:\/([\d.]+))?/i
RequireJS (JavaScript Frameworks) Expand
Detected patterns
- script /require.*\.js/i
- env /^requirejs$/i
TweenMax (JavaScript Frameworks) Expand
Detected patterns
- env /^TweenMax$/i
Google Font API (Font Scripts) Expand
Detected patterns
- html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- env /^jQuery$/i
Piwik () Expand
Detected patterns
- script /piwik\.js|piwik\.php/i
- env /^Piwik$/i
- env /^_paq$/i
Page Statistics
5 Outgoing links
These are links going to different origins than the main page.
Title: Follow this company
Search URL Search Domain Scan URL
Title: Stop Companies House from publishing your address
Search URL Search Domain Scan URL
Title: Policies
Search URL Search Domain Scan URL
Title: Developers
Search URL Search Domain Scan URL
Title: Powered by UCRAFT
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
www.govuk.info/ |
40 KB 10 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
css
fonts.googleapis.com/ |
11 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
public.css
cdn.ucraft.app/userFiles/govuk/css/ |
658 KB 67 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
govuk-template.css
d1dg2mgseur1x.cloudfront.net/stylesheets/assets-digital-cabinet-office-gov-uk-static/ |
14 KB 14 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
frontend-application.css
d1dg2mgseur1x.cloudfront.net/stylesheets/assets-digital-cabinet-office-gov-uk-static/ |
63 KB 63 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
application.css
d1dg2mgseur1x.cloudfront.net/stylesheets/ |
314 KB 315 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
jquery-ui.css
d1dg2mgseur1x.cloudfront.net/stylesheets/ |
33 KB 34 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
require.js
d1dg2mgseur1x.cloudfront.net/javascripts/vendor/ |
81 KB 81 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
accounts-pdf.js
d1dg2mgseur1x.cloudfront.net/javascripts/app/ |
6 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.12.4/ |
95 KB 33 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
jquery-3.2.1.min.js
static.ucraft.app/assets/jQuery/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
publicAssets.js
static.ucraft.app/assets/js/ |
353 KB 102 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
public.js
static.ucraft.app/assets/js/ |
71 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
icomoon.css
static.ucraft.app/assets/fonts/ |
17 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
govuk-template-print.css
d1dg2mgseur1x.cloudfront.net/stylesheets/assets-digital-cabinet-office-gov-uk-static/ |
1 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
print.css
d1dg2mgseur1x.cloudfront.net/stylesheets/assets-digital-cabinet-office-gov-uk-static/ |
5 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
print.css
d1dg2mgseur1x.cloudfront.net/stylesheets/ |
3 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
royal-coat-of-arms-white.png
d1dg2mgseur1x.cloudfront.net/images/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v15/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
require-global-config.js
d1dg2mgseur1x.cloudfront.net/javascripts/ |
5 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
19 KB 0 |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
18 KB 0 |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
piwik.js
piwik.companieshouse.gov.uk/ |
23 KB 23 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
927 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headersResponse headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
106211765671436-govuk.png
cdn.ucraft.app/userFiles/govuk/images/ |
43 KB 43 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
piwik.php
piwik.companieshouse.gov.uk/ |
43 B 212 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: UK Government (Government)171 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
string| currentLanguage string| currentLanguagePrefix object| global function| requirejs function| require function| define object| config function| $ function| jQuery object| _paq string| path undefined| newUrl string| docTitle function| bindPiwikListener object| page object| currentLanguageObject number| isTablet number| isMobile number| ucraftWebsiteElementsDisabled number| printElementsEnabled number| siteArchiverEnabled string| croppedUrlPrefix string| userFilesUrl string| accountsUrl string| accountsIframeUrl string| helpUrl string| websiteUrl string| publicAddonsAssetsUrl object| publicUser string| staticUrl boolean| hasEcommerce boolean| hasFlights object| translations object| styleSheetUrls string| _token string| editUrl string| baseUrl string| apiPrefix string| publicApiPrefix string| publicRestPrefix string| pageId object| siteInfo string| googleMapKey function| ll function| raf function| setShowLayoutParamsAllLinks function| getCoords function| fixFooter function| fixHeader object| underHeaderModules function| fixFirstRowMarginTop object| resizeTimeOut function| loadPlayer object| calcTimeout function| calculateVideoBackgroundPosition function| convertToAlias function| showSystemMessage function| hideSystemMessage function| initUploader function| youtubeBackground function| videoId function| startPoint function| setLoadingEffects function| setMasonryLayout function| startLoadingEffects function| makeSlider function| makeGallery number| lastScrollTop object| ucExternalUrl undefined| returnUrl object| _gsScope function| Api undefined| moduleController undefined| marginController object| confirmData undefined| confirmObj function| confirmPopup function| closeConfirmPopup function| capitalizeFirstLetter function| ucRequest undefined| receiveMessage undefined| logout undefined| hash_change undefined| checkUserLogin undefined| iframe_popup_show undefined| iframe_popup_close undefined| signIn object| UcAnchor object| _gsQueue object| GreenSockGlobals object| com function| _gsDefine function| Ease function| Power4 function| Strong function| Quint function| Power3 function| Quart function| Power2 function| Cubic function| Power1 function| Quad function| Power0 function| Linear function| TweenLite function| TweenPlugin function| TweenMax function| TimelineLite function| TimelineMax function| BezierPlugin function| CSSPlugin function| BackOut function| BackIn function| BackInOut object| Back function| SlowMo function| SteppedEase function| ExpoScaleEase function| RoughEase function| BounceOut function| BounceIn function| BounceInOut object| Bounce function| CircOut function| CircIn function| CircInOut object| Circ function| ElasticOut function| ElasticIn function| ElasticInOut object| Elastic function| ExpoOut function| ExpoIn function| ExpoInOut object| Expo function| SineOut function| SineIn function| SineInOut object| Sine object| EaseLookup object| api object| animateEffects object| ucecommerce function| toggleModuleAccordion object| countdown boolean| ecommerceCategoriesBodyClickEventAdded function| ecommerceCategoriesBodyClickEvent object| ecommerceProductModule undefined| resizeTimer function| dots function| onUcraftFormSubmit function| languageSwitcherPosition function| changeLanguage function| initializeMap function| loadJS function| isEmpty function| scrollToFeatures function| activateSwipe function| destroySwipe function| togglePlanRoundButton function| openMobileFeatures function| getCookie function| filterByTag string| hash string| timeout function| initEcommerceSubcategories object| JSON2 object| Piwik object| AnalyticsTracker function| piwik_log object| tv4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.govuk.info/ | Name: _pk_cvar.2.9465 Value: %7B%221%22%3A%5B%22VisitorStatus%22%2C%22NotSignedIn%22%5D%2C%222%22%3A%5B%22CompanyStatus%22%2C%22NotAuthorised%22%5D%7D |
|
www.govuk.info/ | Name: _pk_ses.2.9465 Value: * |
|
www.govuk.info/ | Name: _pk_id.2.9465 Value: 06d293ae48a564c0.1542930568.1.1542930568.1542930568. |
|
www.govuk.info/ | Name: uc_builder Value: eyJpdiI6Ik05RWVPdzNJamw4S29aSFZORXhxeWc9PSIsInZhbHVlIjoiOEdBMDAzZjBmVHdUSEFJeGxGZ0w3Vm9qWWNxdDI0TEpJWlZhXC9cL2lhdmRYeU1OdkZzVHpBcGw1SWloZzVIc2xSIiwibWFjIjoiNjAyMmJmODIzZWQ5OGVjODhjZjY5YjhlZTMwMzkyNDcyM2YyZjZkMGRlNGFkYmJhY2Y2M2E1ZWE2MzE4NWU3ZiJ9 |
5 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
cdn.ucraft.app
d1dg2mgseur1x.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
piwik.companieshouse.gov.uk
static.ucraft.app
www.govuk.info
195.99.215.25
2600:9000:20bb:d600:15:90c8:9d40:21
2606:4700:30::681f:5e77
2a00:1450:4001:812::200a
2a00:1450:4001:81a::2003
2a00:1450:4001:81a::200a
2a00:1450:4001:81b::2013
1b62ee97a74d2252b53c7777e6ee9f5a903aed02c8e456049b48957bef69a0d5
1e9808c2fa87aa900987eee11c56539809c7379132c30a9e6d9b7c8b9c52abf2
24dfa6b5009677c0720d0c365f712d16d7f252240597ce7700e136336fbf76c4
3615fabbba2a8e7d36f6e25790f5d45e9ea1d02fccb5fd5bd4484045fa77a4e1
418b18e665dc6f6798bad294c6509fd9c2a1ff127875f154e9bec0a3e8ff9b95
523ceff581e9394b3757791d6cc7d9a47ced0e3197e4d774a045cd60dad8c2bb
53a3e6a073d986ba45ccc6466c6d192faf6709ff9f52d19f131eeaf01267b948
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
637248614afd230dc800300c6e37ee14ca7b962236fa80b296953ae70bd603c3
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
7cedfa2140f93e3e8c018447d73ddd4dac56ad9ce02ddcea32145b3208202bbd
82307545cb690b7a07f42e4f6e48a5bb1856f42c82acd95ada16bbad05b592f9
8868d2a2f803ea6802d54a11564b5b96c7d8be56117a328c8f605539d6dee167
90df3ecfd311b43c73ddcf659091b1339df53b13af62f03b9e12286856cd2d46
94d4f74e8bfad03d7953570f73480f3e5bf06d780eb814131f37f34a72ef23e0
a009908b9267d066f0a29722f01bc450a0d115370facd0d9164160368078928b
a4e03c8471388325b3cd8a4359cb838191e83b5afaddbdc2a0a972828d735fa5
c4c7af44e1ad58ec88e3fb53d56efcd6a05b9d12a5cc73e1480cfcdc272d137b
da8936c02cb9af21f788c1943dd8e7c11c9cffbe3acee3e0883ea8942cd14fcc
db9a619918337586c044537e371e8af6f50c458d82d6df5781d3d85164aa5b85
db9c23d2c60958ce70eb8af89e9017b6dc7ab8f69cf60d4955e0734ed0c71b77
e0635d94a66c1d6d234bda8c899cbd3825bf10f468239143ceaf3352fd32cd6a
e20eba8380d68d67291f9633b147cafcabfd9ff49e1b88278f6ec2d37dd59104
ed3aeb20c7878bae13d40a018e990c7eca4630b424180d873e35758a15dbc4c3
f314451d4fe82805b8dbd79dae55551e347fe53544c9b6481be3e9dcce052927
f64962aa75e70f8799b38e0ba24b4f132b85cc17a61eb83ea1496345573b6911