frontend.dev.fundingservice.co.uk
Open in
urlscan Pro
2600:9000:225e:1c00:6:26fd:bac0:93a1
Malicious Activity!
Public Scan
URL:
https://frontend.dev.fundingservice.co.uk/
Submission: On July 22 via automatic, source certstream-suspicious — Scanned from DE
Submission: On July 22 via automatic, source certstream-suspicious — Scanned from DE
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 7 HTTP transactions.
The main IP is 2600:9000:225e:1c00:6:26fd:bac0:93a1, located in
United States and
belongs to AMAZON-02, US.
The main domain is frontend.dev.fundingservice.co.uk.
TLS certificate: Issued by Amazon on July 22nd 2022. Valid for: a year.
This is the only time frontend.dev.fundingservice.co.uk was scanned on urlscan.io!
TLS certificate: Issued by Amazon on July 22nd 2022. Valid for: a year.
This is the only time frontend.dev.fundingservice.co.uk was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: UK Government (Government)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 7 | 2600:9000:225... 2600:9000:225e:1c00:6:26fd:bac0:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
| 7 | 1 |
7
2600:9000:225e:1c00:6:26fd:bac0:93a1
(United States)
ASN16509 (AMAZON-02, US)
ASN16509 (AMAZON-02, US)
| frontend.dev.fundingservice.co.uk |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 7 |
fundingservice.co.uk
frontend.dev.fundingservice.co.uk |
98 KB |
| 7 | 1 |
| Domain | Requested by | |
|---|---|---|
| 7 | frontend.dev.fundingservice.co.uk |
frontend.dev.fundingservice.co.uk
|
| 7 | 1 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| github.com |
| pypi.org |
| www.nationalarchives.gov.uk |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| fundingservice.co.uk Amazon |
2022-07-22 - 2023-08-20 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://frontend.dev.fundingservice.co.uk/
Frame ID: 4113E38B9CA2CF055633A2CB096C5490
Requests: 7 HTTP requests in this frame
Screenshot
Page Title
DLUHC Funding Service Design Iteration 2Detected technologies
GOV.UK Frontend
(UI frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?govuk-frontend(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- <body[^>]+govuk-template__body
- govuk-frontend(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Page Statistics
8 Outgoing links
These are links going to different origins than the main page.
URL: https://github.com/alphagov/govuk-frontend/releases/tag/v4.0.0
Title: GOV.UK Frontend v4.0.0
Title: GOV.UK Frontend v4.0.0
Search URL Search Domain Scan URL
URL: https://github.com/LandRegistry/govuk-frontend-jinja/releases/tag/2.0.0
Title: GOV.UK Frontend Jinja v2.0.0
Title: GOV.UK Frontend Jinja v2.0.0
Search URL Search Domain Scan URL
URL: https://github.com/LandRegistry/govuk-frontend-jinja
Title: Package source code
Title: Package source code
Search URL Search Domain Scan URL
URL: https://github.com/LandRegistry/govuk-frontend-jinja/actions
Title: Build pipeline
Title: Build pipeline
Search URL Search Domain Scan URL
URL: https://pypi.org/project/govuk-frontend-jinja/
Title: PyPI package
Title: PyPI package
Search URL Search Domain Scan URL
URL: https://github.com/LandRegistry/govuk-frontend-jinja-demo
Title: Demo source code
Title: Demo source code
Search URL Search Domain Scan URL
URL: https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/
Title: Open Government Licence v3.0
Title: Open Government Licence v3.0
Search URL Search Domain Scan URL
URL: https://www.nationalarchives.gov.uk/information-management/re-using-public-sector-information/uk-government-licensing-framework/crown-copyright/
Title: © Crown copyright
Title: © Crown copyright
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
frontend.dev.fundingservice.co.uk/ |
10 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
tasklist.css
frontend.dev.fundingservice.co.uk/assets/styles/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
govuk-frontend-4.0.0.min.css
frontend.dev.fundingservice.co.uk/assets/ |
103 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
govuk-frontend-4.0.0.min.js
frontend.dev.fundingservice.co.uk/assets/ |
37 KB 10 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
govuk-crest.png
frontend.dev.fundingservice.co.uk/assets/images/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bold-b542beb274-v2.woff2
frontend.dev.fundingservice.co.uk/assets/fonts/ |
31 KB 32 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
light-94a07e06a1-v2.woff2
frontend.dev.fundingservice.co.uk/assets/fonts/ |
33 KB 33 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: UK Government (Government)9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| GOVUKFrontend0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| Content-Security-Policy | default-src 'self'; script-src 'self' 'sha256-+6WnXIl4mbFTCARd8N3COQmT3bJJmo32N8q8ZSQAIcU=' 'sha256-l1eTVSK8DTnK8+yloud7wZUqFrI0atVo6VlC6PJvYaQ='; connect-src ; img-src data: 'self' |
| Strict-Transport-Security | max-age=31556926; includeSubDomains; preload |
| X-Content-Type-Options | nosniff |
| X-Frame-Options | SAMEORIGIN |
| X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
frontend.dev.fundingservice.co.uk
2600:9000:225e:1c00:6:26fd:bac0:93a1
06eba01b1af0f4014b484c711771fef1db30becbf0edf481498da1e4958d3d47
59e371960bc575608202be1d3212cca6a5dbe33634451542b6a3ed0744cd00b9
bb9e22aff7881b895c2ceb41d9340804451c474b883f09fe1b4026e76456f44b
cb77204a25b0671612361ab8a102a487a3c9747e1e7d68f59f6b703371bd7438
ddc727a485ce9b656be62aec6da0bc80b6e644c0b7d2b0bf0cb0b9dd3b42daf5
ed454df4832cb0ab54508c49758852f09389e1ffc76856827bf77c6be4409fd2
eedfb3c2f7945caebd0b15522b59d6c7f01be17fecd6102fd76452ad4042f7b0