pandp64.co.uk Open in urlscan Pro
213.5.71.103  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://www.joytogroup.com/wp-content/ Page URL
2. https://picestudios.com/wp-content/upgrade/boaredhsb/ Page URL
3. https://pandp64.co.uk/wp-content/upgrade/boaredhsb/ Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ www.joytogroup.com/wp-content/	119 B 227 B	69ms 19ms	Document text/html	80.247.175.21 DENIT-AS Amsterdam
General Check archive.org Show headers Download Go to Full URL https://www.joytogroup.com/wp-content/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 80.247.175.21 , Netherlands, ASN25542 (DENIT-AS Amsterdam, NL), Reverse DNS web12.movenext.nl Software nginx / PHP/7.3.25 PleskLin Resource Hash Request headers :method GET :authority www.joytogroup.com :scheme https :path /wp-content/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers server nginx date Tue, 08 Dec 2020 17:32:08 GMT content-type text/html; charset=UTF-8 x-powered-by PHP/7.3.25 PleskLin
GET H/1.1	200 OK	/ Show response picestudios.com/wp-content/upgrade/boaredhsb/	117 B 402 B	343ms 66ms	Document text/html	212.34.145.211 AXARNET-AS
General Check archive.org Show headers Download Go to Full URL https://picestudios.com/wp-content/upgrade/boaredhsb/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 212.34.145.211 , Spain, ASN50926 (AXARNET-AS, ES), Reverse DNS Software Apache/2 / PHP/7.4.13 Resource Hash dff0c27bdad608038fbe31ab75fe341d9fe4fdf612b0b887a8324f09d7e345e3 Request headers Host picestudios.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest document Referer https://www.joytogroup.com/wp-content/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.joytogroup.com/wp-content/ Response headers Date Tue, 08 Dec 2020 17:32:08 GMT Server Apache/2 X-Powered-By PHP/7.4.13 Vary Accept-Encoding,User-Agent Content-Encoding gzip Content-Length 127 Keep-Alive timeout=2, max=100 Connection Keep-Alive Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	Primary Request Cookie set / Show response pandp64.co.uk/wp-content/upgrade/boaredhsb/	389 B 742 B	177ms 129ms	Document text/html	213.5.71.103 ALTUS
General Check archive.org Show headers Download Go to Full URL https://pandp64.co.uk/wp-content/upgrade/boaredhsb/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 213.5.71.103 , Netherlands, ASN51430 (ALTUS, NL), Reverse DNS server.ukserver360.com Software Apache / Resource Hash ea771cbf42a69918c0f50d76bf7b318ea505715f81dcd60e6b264967ea488793 Request headers Host pandp64.co.uk Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest document Referer https://picestudios.com/wp-content/upgrade/boaredhsb/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://picestudios.com/wp-content/upgrade/boaredhsb/ Response headers Date Tue, 08 Dec 2020 17:32:08 GMT Server Apache Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Set-Cookie cazanova=0de695221c5e05f045bd873d270ab29a43814783; expires=Tue, 08-Dec-2020 19:32:08 GMT; Max-Age=7200; path=/; HttpOnly Vary Accept-Encoding Content-Encoding gzip Content-Length 262 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	captcha.js Show response pandp64.co.uk/wp-content/upgrade/boaredhsb/assets/js/	118 KB 42 KB	50ms 50ms	Script application/javascript	213.5.71.103 ALTUS
General Check archive.org Show headers Download Go to Full URL https://pandp64.co.uk/wp-content/upgrade/boaredhsb/assets/js/captcha.js Requested by Host: pandp64.co.uk URL: https://pandp64.co.uk/wp-content/upgrade/boaredhsb/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 213.5.71.103 , Netherlands, ASN51430 (ALTUS, NL), Reverse DNS server.ukserver360.com Software Apache / Resource Hash 7b0159b18a5fbaea723b6b95de2f895aee4e41db740e241599c86bbb6f6f1988 Request headers Referer https://pandp64.co.uk/wp-content/upgrade/boaredhsb/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 08 Dec 2020 17:32:08 GMT Content-Encoding gzip Last-Modified Tue, 01 Dec 2020 02:23:36 GMT Server Apache Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 43160
GET H/1.1	200 OK	captcha.png pandp64.co.uk/wp-content/upgrade/boaredhsb/	19 KB 19 KB	106ms 105ms	Image image/png	213.5.71.103 ALTUS
General Check archive.org Show headers Download Go to Show image Full URL https://pandp64.co.uk/wp-content/upgrade/boaredhsb/captcha.png?_1607448730671 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 213.5.71.103 , Netherlands, ASN51430 (ALTUS, NL), Reverse DNS server.ukserver360.com Software Apache / Resource Hash 22d999e58b9be38e7a48962800bed2d67c1f2d791c4bc388193a2fe90ca827e5 Request headers Referer https://pandp64.co.uk/wp-content/upgrade/boaredhsb/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Pragma no-cache Date Tue, 08 Dec 2020 17:32:10 GMT Content-Encoding gzip Server Apache Vary Accept-Encoding Content-Type image/png Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Keep-Alive timeout=5, max=98 Content-Length 19427 Expires Thu, 19 Nov 1981 08:52:00 GMT
GET H/1.1	200 OK	logo-129x32.svg pandp64.co.uk/wp-content/upgrade/boaredhsb/assets/main/images/	5 KB 2 KB	76ms 38ms	Image image/svg+xml	213.5.71.103 ALTUS
General Check archive.org Show headers Download Go to Show image Full URL https://pandp64.co.uk/wp-content/upgrade/boaredhsb/assets/main/images/logo-129x32.svg Requested by Host: pandp64.co.uk URL: https://pandp64.co.uk/wp-content/upgrade/boaredhsb/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 213.5.71.103 , Netherlands, ASN51430 (ALTUS, NL), Reverse DNS server.ukserver360.com Software Apache / Resource Hash 507ea8a27c8892c5461063d3a2c1534c5c847c48577f60d3a0ffb441c3c518ca Request headers Referer https://pandp64.co.uk/wp-content/upgrade/boaredhsb/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 08 Dec 2020 17:32:10 GMT Content-Encoding gzip Last-Modified Tue, 01 Dec 2020 02:23:36 GMT Server Apache Vary Accept-Encoding Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 2228

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Bank of America (Banking)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| setImmediate function| clearImmediate function| Vue

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			pandp64.co.uk/	1970-01-19 14:30:55	Name: cazanova Value: 0de695221c5e05f045bd873d270ab29a43814783

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

pandp64.co.uk
picestudios.com
www.joytogroup.com
212.34.145.211
213.5.71.103
80.247.175.21
22d999e58b9be38e7a48962800bed2d67c1f2d791c4bc388193a2fe90ca827e5
507ea8a27c8892c5461063d3a2c1534c5c847c48577f60d3a0ffb441c3c518ca
7b0159b18a5fbaea723b6b95de2f895aee4e41db740e241599c86bbb6f6f1988
dff0c27bdad608038fbe31ab75fe341d9fe4fdf612b0b887a8324f09d7e345e3
ea771cbf42a69918c0f50d76bf7b318ea505715f81dcd60e6b264967ea488793