www-gov-uk-government-organisations-hm-revenue-customs.s3.eu-west-2.amazonaws.com
Open in
urlscan Pro
52.95.150.194
Malicious Activity!
Public Scan
Submission Tags: falconsandbox
Submission: On August 13 via api from US
Summary
TLS certificate: Issued by DigiCert Baltimore CA-2 G2 on January 14th 2021. Valid for: a year.
This is the only time www-gov-uk-government-organisations-hm-revenue-customs.s3.eu-west-2.amazonaws.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: UK Government (Government)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 52.95.150.194 52.95.150.194 | 16509 (AMAZON-02) (AMAZON-02) | |
6 | 104.109.90.232 104.109.90.232 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
12 | 3 |
ASN16509 (AMAZON-02, US)
PTR: s3-r-w.eu-west-2.amazonaws.com
www-gov-uk-government-organisations-hm-revenue-customs.s3.eu-west-2.amazonaws.com |
ASN16625 (AKAMAI-AS, US)
PTR: a104-109-90-232.deploy.static.akamaitechnologies.com
www.tax.service.gov.uk |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
service.gov.uk
www.tax.service.gov.uk |
139 KB |
2 |
amazonaws.com
www-gov-uk-government-organisations-hm-revenue-customs.s3.eu-west-2.amazonaws.com |
18 KB |
12 | 2 |
Domain | Requested by | |
---|---|---|
6 | www.tax.service.gov.uk |
www-gov-uk-government-organisations-hm-revenue-customs.s3.eu-west-2.amazonaws.com
www.tax.service.gov.uk |
2 | www-gov-uk-government-organisations-hm-revenue-customs.s3.eu-west-2.amazonaws.com |
www-gov-uk-government-organisations-hm-revenue-customs.s3.eu-west-2.amazonaws.com
|
12 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.tax.service.gov.uk |
www.gov.uk |
www.nationalarchives.gov.uk |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.s3.eu-west-2.amazonaws.com DigiCert Baltimore CA-2 G2 |
2021-01-14 - 2022-01-18 |
a year | crt.sh |
online.hmrc.gov.uk DigiCert SHA2 Extended Validation Server CA |
2021-07-01 - 2022-03-21 |
9 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://www-gov-uk-government-organisations-hm-revenue-customs.s3.eu-west-2.amazonaws.com/index.htm
Frame ID: 089E4BCA79D50C424C4449515EA36940
Requests: 12 HTTP requests in this frame
Screenshot
Detected technologies
Amazon Web Services (PaaS) ExpandDetected patterns
- headers server /^AmazonS3$/i
Amazon S3 (Miscellaneous) Expand
Detected patterns
- headers server /^AmazonS3$/i
Page Statistics
11 Outgoing links
These are links going to different origins than the main page.
Title: GOV.UK
Search URL Search Domain Scan URL
Title: Newid yr iaith ir Gymraeg Cymraeg
Search URL Search Domain Scan URL
Title: Cookies
Search URL Search Domain Scan URL
Title: Accessibility statement
Search URL Search Domain Scan URL
Title: Privacy policy
Search URL Search Domain Scan URL
Title: Terms and conditions
Search URL Search Domain Scan URL
Title: Help using GOV.UK
Search URL Search Domain Scan URL
Title: Contact
Search URL Search Domain Scan URL
Title: Rhestr o Wasanaethau Cymraeg
Search URL Search Domain Scan URL
Title: Open Government Licence v3.0
Search URL Search Domain Scan URL
Title: © Crown copyright
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
index.htm
www-gov-uk-government-organisations-hm-revenue-customs.s3.eu-west-2.amazonaws.com/ |
16 KB 17 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styles.css
www.tax.service.gov.uk/personal-details-validation/assets/stylesheets/ |
133 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sub.png
www-gov-uk-government-organisations-hm-revenue-customs.s3.eu-west-2.amazonaws.com/ |
736 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
all.js
www.tax.service.gov.uk/personal-details-validation/assets/lib/govuk-frontend/govuk/ |
88 KB 89 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
all.js
www.tax.service.gov.uk/personal-details-validation/assets/lib/hmrc-frontend/hmrc/ |
120 KB 25 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
scripts-govuk-frontend.js
www.tax.service.gov.uk/personal-details-validation/assets/javascripts/ |
65 B 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
gtm_dl.js
www.tax.service.gov.uk/personal-details-validation/assets/javascripts/ |
951 B 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
light-94a07e06a1-v2.woff2
www.tax.service.gov.uk/personal-details-validation/assets/lib/govuk-frontend/govuk/assets/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
govuk-crest.png
www.tax.service.gov.uk/personal-details-validation/assets/lib/govuk-frontend/govuk/assets/images/ |
4 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
bold-b542beb274-v2.woff2
www.tax.service.gov.uk/personal-details-validation/assets/lib/govuk-frontend/govuk/assets/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
light-f591b13f7d-v2.woff
www.tax.service.gov.uk/personal-details-validation/assets/lib/govuk-frontend/govuk/assets/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
bold-affa96571d-v2.woff
www.tax.service.gov.uk/personal-details-validation/assets/lib/govuk-frontend/govuk/assets/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- www.tax.service.gov.uk
- URL
- https://www.tax.service.gov.uk/personal-details-validation/assets/lib/govuk-frontend/govuk/assets/fonts/light-94a07e06a1-v2.woff2
- Domain
- www.tax.service.gov.uk
- URL
- https://www.tax.service.gov.uk/personal-details-validation/assets/lib/govuk-frontend/govuk/assets/fonts/bold-b542beb274-v2.woff2
- Domain
- www.tax.service.gov.uk
- URL
- https://www.tax.service.gov.uk/personal-details-validation/assets/lib/govuk-frontend/govuk/assets/fonts/light-f591b13f7d-v2.woff
- Domain
- www.tax.service.gov.uk
- URL
- https://www.tax.service.gov.uk/personal-details-validation/assets/lib/govuk-frontend/govuk/assets/fonts/bold-affa96571d-v2.woff
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: UK Government (Government)14 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| GOVUKFrontend object| HMRCFrontend object| dataLayer0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
www-gov-uk-government-organisations-hm-revenue-customs.s3.eu-west-2.amazonaws.com
www.tax.service.gov.uk
www.tax.service.gov.uk
104.109.90.232
52.95.150.194
3141d4bfc6483010ce95b086e872b2f62b44a8eef5d9ca80f1334fccfad18b00
42f6ff88d973800ab927b60d1cecf072391b86cdddfaf1d597144f5cc0789fa3
4fe60970ad0c47f265e455eb0ae1602b3f521d0d1b2d1f701857a9545d176c12
6d87b66743ece66a11850627f776b21c9c35879a2e11b18a24c99ff926cf26d4
9c5db45a4c8cfb16f7a84511712d027456ac77a7035e3d08d7953a71ef7309d6
bb9e22aff7881b895c2ceb41d9340804451c474b883f09fe1b4026e76456f44b
c23338e2df8977b202fc1997b5abf81b7178efcb8994367d802b884e47d5d2c5
c5e1e0edbabafe167ff8482a2ee6f5577e3c7ae94ff9dfbdbdb230b6f5cb65a6