hmrc.life Open in urlscan Pro
162.0.235.111  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request login.php Show response hmrc.life/	5 KB 2 KB	677ms 337ms	Document text/html	162.0.235.111 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://hmrc.life/login.php?id=a886f0a7617044a58895ae2301530f3ea886f0a7617044a58895ae2301530f3e&session=a886f0a7617044a58895ae2301530f3ea886f0a7617044a58895ae2301530f3e Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.0.235.111 , Canada, ASN22612 (NAMECHEAP-NET, US), Reverse DNS business84-5.web-hosting.com Software Apache / PHP/7.2.34 Resource Hash 1ceb8fe325c3a2d9144f194ac79fd8a9a9ddbb2e0f15f583baf2e4a1fa19b0c7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :method GET :authority hmrc.life :scheme https :path /login.php?id=a886f0a7617044a58895ae2301530f3ea886f0a7617044a58895ae2301530f3e&session=a886f0a7617044a58895ae2301530f3ea886f0a7617044a58895ae2301530f3e pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 04 Jan 2021 15:04:23 GMT server Apache x-powered-by PHP/7.2.34 expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate pragma no-cache set-cookie PHPSESSID=db8e5a53fad468fb69fc6c8679c4d89a; path=/ vary Accept-Encoding content-encoding gzip x-content-type nosniff x_forwarded_for 104.16.77.187 remote_addr 104.16.77.187 host www.fbi.gov origin https://www.fbi.gov referer https://www.fbi.gov x-forwarded-host www.fbi.gov x-forwarded-proto https x-xss-protection 1; mode=block content-length 1821 content-type text/html; charset=UTF-8 x-frame-options SAMEORIGIN x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains; preload; referrer-policy no-referrer-when-downgrade
GET H2	200	contextualLogin.css hmrc.life/styles/css/	121 KB 18 KB	438ms 437ms	Stylesheet text/css	162.0.235.111 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://hmrc.life/styles/css/contextualLogin.css Requested by Host: hmrc.life URL: https://hmrc.life/login.php?id=a886f0a7617044a58895ae2301530f3ea886f0a7617044a58895ae2301530f3e&session=a886f0a7617044a58895ae2301530f3ea886f0a7617044a58895ae2301530f3e Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.0.235.111 , Canada, ASN22612 (NAMECHEAP-NET, US), Reverse DNS business84-5.web-hosting.com Software Apache / Resource Hash 75ebfef9aa4f0fb225b44877b6ded87be068dea020f2471f09dd139f8c319024 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://hmrc.life/login.php?id=a886f0a7617044a58895ae2301530f3ea886f0a7617044a58895ae2301530f3e&session=a886f0a7617044a58895ae2301530f3ea886f0a7617044a58895ae2301530f3e User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 04 Jan 2021 15:04:23 GMT content-encoding gzip origin https://www.fbi.gov strict-transport-security max-age=31536000; includeSubDomains; preload; x_forwarded_for 104.16.77.187 x-forwarded-proto https vary Accept-Encoding content-length 17898 x-xss-protection 1; mode=block server Apache x-content-type nosniff referrer-policy no-referrer-when-downgrade remote_addr 104.16.77.187 last-modified Sat, 25 Apr 2020 12:24:56 GMT x-forwarded-host www.fbi.gov host www.fbi.gov x-frame-options SAMEORIGIN content-type text/css referer https://www.fbi.gov accept-ranges bytes x-content-type-options nosniff
GET H2	200	centerlogo.svg hmrc.life/images/	5 KB 2 KB	438ms 437ms	Image image/svg+xml	162.0.235.111 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://hmrc.life/images/centerlogo.svg Requested by Host: hmrc.life URL: https://hmrc.life/login.php?id=a886f0a7617044a58895ae2301530f3ea886f0a7617044a58895ae2301530f3e&session=a886f0a7617044a58895ae2301530f3ea886f0a7617044a58895ae2301530f3e Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.0.235.111 , Canada, ASN22612 (NAMECHEAP-NET, US), Reverse DNS business84-5.web-hosting.com Software Apache / Resource Hash fa218e6d0b586a0ca48b577e3c8d30be88d45b1318715134645dedf5efc18e6e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://hmrc.life/login.php?id=a886f0a7617044a58895ae2301530f3ea886f0a7617044a58895ae2301530f3e&session=a886f0a7617044a58895ae2301530f3ea886f0a7617044a58895ae2301530f3e User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 04 Jan 2021 15:04:23 GMT content-encoding gzip origin https://www.fbi.gov strict-transport-security max-age=31536000; includeSubDomains; preload; x_forwarded_for 104.16.77.187 x-forwarded-proto https vary Accept-Encoding content-length 1745 x-xss-protection 1; mode=block server Apache x-content-type nosniff referrer-policy no-referrer-when-downgrade remote_addr 104.16.77.187 last-modified Sat, 25 Apr 2020 12:20:16 GMT x-forwarded-host www.fbi.gov host www.fbi.gov x-frame-options SAMEORIGIN content-type image/svg+xml referer https://www.fbi.gov accept-ranges bytes x-content-type-options nosniff
GET H2	200	signin-split.js Show response hmrc.life/images/js/	128 KB 32 KB	318ms 318ms	Script application/javascript	162.0.235.111 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://hmrc.life/images/js/signin-split.js Requested by Host: hmrc.life URL: https://hmrc.life/login.php?id=a886f0a7617044a58895ae2301530f3ea886f0a7617044a58895ae2301530f3e&session=a886f0a7617044a58895ae2301530f3ea886f0a7617044a58895ae2301530f3e Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.0.235.111 , Canada, ASN22612 (NAMECHEAP-NET, US), Reverse DNS business84-5.web-hosting.com Software Apache / Resource Hash 58313b929bf3b19ddfb3a5e769cbd3618f7f1ea8983388c595ce7635dbc5dee8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://hmrc.life/login.php?id=a886f0a7617044a58895ae2301530f3ea886f0a7617044a58895ae2301530f3e&session=a886f0a7617044a58895ae2301530f3ea886f0a7617044a58895ae2301530f3e User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 04 Jan 2021 15:04:23 GMT content-encoding gzip origin https://www.fbi.gov strict-transport-security max-age=31536000; includeSubDomains; preload; x_forwarded_for 104.16.77.187 x-forwarded-proto https vary Accept-Encoding content-length 32369 x-xss-protection 1; mode=block server Apache x-content-type nosniff referrer-policy no-referrer-when-downgrade remote_addr 104.16.77.187 last-modified Sat, 25 Apr 2020 12:20:34 GMT x-forwarded-host www.fbi.gov host www.fbi.gov x-frame-options SAMEORIGIN content-type application/javascript referer https://www.fbi.gov accept-ranges bytes x-content-type-options nosniff

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| validateUser object| PAYPAL function| $

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			hmrc.life/	1969-12-31 23:59:59	Name: PHPSESSID Value: db8e5a53fad468fb69fc6c8679c4d89a

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

hmrc.life
162.0.235.111
1ceb8fe325c3a2d9144f194ac79fd8a9a9ddbb2e0f15f583baf2e4a1fa19b0c7
58313b929bf3b19ddfb3a5e769cbd3618f7f1ea8983388c595ce7635dbc5dee8
75ebfef9aa4f0fb225b44877b6ded87be068dea020f2471f09dd139f8c319024
fa218e6d0b586a0ca48b577e3c8d30be88d45b1318715134645dedf5efc18e6e