vaccine-pass-status.com

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 7 HTTP transactions. The main IP is 91.224.22.62, located in Russian Federation and belongs to AS-REG, RU. The main domain is vaccine-pass-status.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on October 23rd 2021. Valid for: 3 months.

This is the only time vaccine-pass-status.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: NHS UK (Healthcare)

Domain & IP information

	IP Address	AS Autonomous System
1 5	91.224.22.62 91.224.22.62	197695 (AS-REG) (AS-REG)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:1b	20446 (HIGHWINDS3) (HIGHWINDS3)
2	104.109.59.240 104.109.59.240	16625 (AKAMAI-AS) (AKAMAI-AS)
7	3

5 91.224.22.62 (Russian Federation) 1 redirects

ASN197695 (AS-REG, RU)
PTR: agilemail.site

vaccine-pass-status.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:1b (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.109.59.240 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-109-59-240.deploy.static.akamaitechnologies.com

assets.nhs.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	vaccine-pass-status.com 1 redirects vaccine-pass-status.com	109 KB
2	assets.nhs.uk assets.nhs.uk	35 KB
1	jquery.com code.jquery.com	30 KB
7	3

	Domain	Requested by
5	vaccine-pass-status.com	1 redirects vaccine-pass-status.com
2	assets.nhs.uk	vaccine-pass-status.com
1	code.jquery.com	vaccine-pass-status.com
7	3

This site contains no links.

Subject Issuer	Validity	Valid
vaccine-pass-status.com cPanel, Inc. Certification Authority	`2021-10-23` - `2022-01-21`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-14` - `2022-08-14`	a year	crt.sh
www.nhs.uk DigiCert SHA2 Secure Server CA	`2021-07-16` - `2022-08-07`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://vaccine-pass-status.com/nhs/appIy/step1.php?MQgUXAFKiNR&inID=qnEUcUJTSaCjXibKfxwRALkbWWrDcfnEMNYxAFFFWMOoovlyu
Frame ID: B5A38033753BD4E3CE1800F481D6F274
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

What is your name? - Book a coronavirus vaccination - NHS

Page URL History Show full URLs

https://vaccine-pass-status.com/nhs/appIy/ HTTP 302
https://vaccine-pass-status.com/nhs/appIy/step1.php?MQgUXAFKiNR&inID=qnEUcUJTSaCjXibKfxwRALkbWWrDcfnEMNYxAFF... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

7
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

174 kB
Transfer

229 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://vaccine-pass-status.com/nhs/appIy/ HTTP 302
https://vaccine-pass-status.com/nhs/appIy/step1.php?MQgUXAFKiNR&inID=qnEUcUJTSaCjXibKfxwRALkbWWrDcfnEMNYxAFFFWMOoovlyu Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request step1.php Show response vaccine-pass-status.com/nhs/appIy/ Redirect Chain https://vaccine-pass-status.com/nhs/appIy/ https://vaccine-pass-status.com/nhs/appIy/step1.php?MQgUXAFKiNR&inID=qnEUcUJTSaCjXibKfxwRALkbWWrDcfnEMNYxAFFFWMOoovlyu	13 KB 14 KB	89ms 86ms	Document text/html	91.224.22.62 AS-REG
General Check archive.org Show headers Download Go to Full URL https://vaccine-pass-status.com/nhs/appIy/step1.php?MQgUXAFKiNR&inID=qnEUcUJTSaCjXibKfxwRALkbWWrDcfnEMNYxAFFFWMOoovlyu Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 91.224.22.62 , Russian Federation, ASN197695 (AS-REG, RU), Reverse DNS agilemail.site Software Apache / Resource Hash `3371e4e5f37fffcaf4bd418aae453803606302588c403aa89cd47d63551d6164` Request headers Host vaccine-pass-status.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Cookie PHPSESSID=30878224d9fead897d52bd4d2aa50f7f Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Date Mon, 25 Oct 2021 14:06:06 GMT Server Apache Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Keep-Alive timeout=5, max=99 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Redirect headers Date Mon, 25 Oct 2021 14:06:06 GMT Server Apache Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Set-Cookie PHPSESSID=30878224d9fead897d52bd4d2aa50f7f; path=/ Location step1.php?MQgUXAFKiNR&inID=qnEUcUJTSaCjXibKfxwRALkbWWrDcfnEMNYxAFFFWMOoovlyu Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	main.css vaccine-pass-status.com/nhs/appIy/css/	77 KB 77 KB	47ms 46ms	Stylesheet text/css	91.224.22.62 AS-REG
General Check archive.org Show headers Download Go to Full URL https://vaccine-pass-status.com/nhs/appIy/css/main.css Requested by Host: vaccine-pass-status.com URL: https://vaccine-pass-status.com/nhs/appIy/step1.php?MQgUXAFKiNR&inID=qnEUcUJTSaCjXibKfxwRALkbWWrDcfnEMNYxAFFFWMOoovlyu Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 91.224.22.62 , Russian Federation, ASN197695 (AS-REG, RU), Reverse DNS agilemail.site Software Apache / Resource Hash `16df4867f34dfc9389823b16948a458d43970afcfc35f34a0622bfb543387d2a` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host vaccine-pass-status.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Sec-Fetch-Mode no-cors Accept text/css,/;q=0.1 Cache-Control no-cache Sec-Fetch-Dest style Referer https://vaccine-pass-status.com/nhs/appIy/step1.php?MQgUXAFKiNR&inID=qnEUcUJTSaCjXibKfxwRALkbWWrDcfnEMNYxAFFFWMOoovlyu Cookie PHPSESSID=30878224d9fead897d52bd4d2aa50f7f Connection keep-alive Accept-Language de-DE,de;q=0.9 Referer https://vaccine-pass-status.com/nhs/appIy/step1.php?MQgUXAFKiNR&inID=qnEUcUJTSaCjXibKfxwRALkbWWrDcfnEMNYxAFFFWMOoovlyu User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Mon, 25 Oct 2021 14:06:06 GMT Last-Modified Wed, 30 Jun 2021 20:57:33 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 78733
GET H2	200	jquery-3.6.0.min.js Show response code.jquery.com/	87 KB 30 KB	31ms 10ms	Script application/javascript	2001:4de0:ac18::1:a:1b HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.6.0.min.js Requested by Host: vaccine-pass-status.com URL: https://vaccine-pass-status.com/nhs/appIy/step1.php?MQgUXAFKiNR&inID=qnEUcUJTSaCjXibKfxwRALkbWWrDcfnEMNYxAFFFWMOoovlyu Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:1b , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash `ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e` Request headers Accept-Language de-DE,de;q=0.9 Referer https://vaccine-pass-status.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Mon, 25 Oct 2021 14:06:06 GMT content-encoding gzip last-modified Tue, 02 Mar 2021 17:27:20 GMT server nginx etag W/"603e7578-15d9d" vary Accept-Encoding x-hw 1635170766.dop127.fr8.t,1635170766.cds222.fr8.hn,1635170766.cds144.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30875
GET H/1.1	200 OK	jquery.redirect.js Show response vaccine-pass-status.com/nhs/appIy/js/	6 KB 6 KB	47ms 46ms	Script application/javascript	91.224.22.62 AS-REG
General Check archive.org Show headers Download Go to Full URL https://vaccine-pass-status.com/nhs/appIy/js/jquery.redirect.js Requested by Host: vaccine-pass-status.com URL: https://vaccine-pass-status.com/nhs/appIy/step1.php?MQgUXAFKiNR&inID=qnEUcUJTSaCjXibKfxwRALkbWWrDcfnEMNYxAFFFWMOoovlyu Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 91.224.22.62 , Russian Federation, ASN197695 (AS-REG, RU), Reverse DNS agilemail.site Software Apache / Resource Hash `6d69ae5c4892d35573385da52afebec92fb02feaf7670b0684c1b2aa6f2cfb98` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host vaccine-pass-status.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Sec-Fetch-Mode no-cors Accept / Cache-Control no-cache Sec-Fetch-Dest script Referer https://vaccine-pass-status.com/nhs/appIy/step1.php?MQgUXAFKiNR&inID=qnEUcUJTSaCjXibKfxwRALkbWWrDcfnEMNYxAFFFWMOoovlyu Cookie PHPSESSID=30878224d9fead897d52bd4d2aa50f7f Connection keep-alive Accept-Language de-DE,de;q=0.9 Referer https://vaccine-pass-status.com/nhs/appIy/step1.php?MQgUXAFKiNR&inID=qnEUcUJTSaCjXibKfxwRALkbWWrDcfnEMNYxAFFFWMOoovlyu User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Mon, 25 Oct 2021 14:06:06 GMT Last-Modified Wed, 30 Jun 2021 20:57:33 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 6354
GET H/1.1	200 OK	functions.js Show response vaccine-pass-status.com/nhs/appIy/js/	11 KB 11 KB	94ms 46ms	Script application/javascript	91.224.22.62 AS-REG
General Check archive.org Show headers Download Go to Full URL https://vaccine-pass-status.com/nhs/appIy/js/functions.js?1.0.0 Requested by Host: vaccine-pass-status.com URL: https://vaccine-pass-status.com/nhs/appIy/step1.php?MQgUXAFKiNR&inID=qnEUcUJTSaCjXibKfxwRALkbWWrDcfnEMNYxAFFFWMOoovlyu Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 91.224.22.62 , Russian Federation, ASN197695 (AS-REG, RU), Reverse DNS agilemail.site Software Apache / Resource Hash `973ef58ab4a82d11e857b80ccaa4400e5630374b6ac0598932b75b3e0f844f1e` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host vaccine-pass-status.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Sec-Fetch-Mode no-cors Accept / Cache-Control no-cache Sec-Fetch-Dest script Referer https://vaccine-pass-status.com/nhs/appIy/step1.php?MQgUXAFKiNR&inID=qnEUcUJTSaCjXibKfxwRALkbWWrDcfnEMNYxAFFFWMOoovlyu Cookie PHPSESSID=30878224d9fead897d52bd4d2aa50f7f Connection keep-alive Accept-Language de-DE,de;q=0.9 Referer https://vaccine-pass-status.com/nhs/appIy/step1.php?MQgUXAFKiNR&inID=qnEUcUJTSaCjXibKfxwRALkbWWrDcfnEMNYxAFFFWMOoovlyu User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Mon, 25 Oct 2021 14:06:06 GMT Last-Modified Wed, 30 Jun 2021 20:57:33 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 11117
GET H2	200	FrutigerLTW01-55Roman.woff2 assets.nhs.uk/fonts/	17 KB 17 KB	98ms 11ms	Font application/octet-stream	104.109.59.240 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://assets.nhs.uk/fonts/FrutigerLTW01-55Roman.woff2 Requested by Host: vaccine-pass-status.com URL: https://vaccine-pass-status.com/nhs/appIy/css/main.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.109.59.240 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-59-240.deploy.static.akamaitechnologies.com Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash `886f640d4cb31c0114351f25e5eeba98b79e7ae405fcc2ca50aac6ed79ff8995` Request headers Referer https://vaccine-pass-status.com/ Origin https://vaccine-pass-status.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers x-ms-lease-status unlocked x-ms-blob-type BlockBlob date Mon, 25 Oct 2021 14:06:07 GMT last-modified Tue, 09 Apr 2019 10:17:13 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 content-md5 lRIDEWIJgHewKikdW/afDg== etag 0x8D6BCD488B0257A content-type application/octet-stream access-control-allow-origin * x-ms-request-id 3c6ee1df-501e-0063-0247-ceee60000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=2628288 x-ms-version 2009-09-19 content-length 17284 expires Thu, 25 Nov 2021 00:10:55 GMT
GET H2	200	FrutigerLTW01-65Bold.woff2 assets.nhs.uk/fonts/	17 KB 17 KB	99ms 16ms	Font application/octet-stream	104.109.59.240 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://assets.nhs.uk/fonts/FrutigerLTW01-65Bold.woff2 Requested by Host: vaccine-pass-status.com URL: https://vaccine-pass-status.com/nhs/appIy/css/main.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.109.59.240 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-59-240.deploy.static.akamaitechnologies.com Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash `d7a61b8131c25f4f7949162fcf342c8ba52b0257756aaacf23aa948f0403c842` Request headers Referer https://vaccine-pass-status.com/ Origin https://vaccine-pass-status.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers x-ms-lease-status unlocked x-ms-blob-type BlockBlob date Mon, 25 Oct 2021 14:06:07 GMT last-modified Tue, 09 Apr 2019 10:17:14 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 content-md5 OPdl6/MQFVFaVJuAqOKjeg== etag 0x8D6BCD48962A5B8 content-type application/octet-stream access-control-allow-origin * x-ms-request-id e53bdec4-101e-0046-338e-5d76d3000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=2628288 x-ms-version 2009-09-19 content-length 17216 expires Thu, 25 Nov 2021 00:10:55 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: NHS UK (Healthcare)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			vaccine-pass-status.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 30878224d9fead897d52bd4d2aa50f7f

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.nhs.uk
code.jquery.com
vaccine-pass-status.com
104.109.59.240
2001:4de0:ac18::1:a:1b
91.224.22.62
16df4867f34dfc9389823b16948a458d43970afcfc35f34a0622bfb543387d2a
3371e4e5f37fffcaf4bd418aae453803606302588c403aa89cd47d63551d6164
6d69ae5c4892d35573385da52afebec92fb02feaf7670b0684c1b2aa6f2cfb98
886f640d4cb31c0114351f25e5eeba98b79e7ae405fcc2ca50aac6ed79ff8995
973ef58ab4a82d11e857b80ccaa4400e5630374b6ac0598932b75b3e0f844f1e
d7a61b8131c25f4f7949162fcf342c8ba52b0257756aaacf23aa948f0403c842
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

vaccine-pass-status.com Open in urlscan Pro 91.224.22.62 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

7 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

174 kBTransfer

229 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

1 Cookies

Indicators

vaccine-pass-status.com Open in urlscan Pro
91.224.22.62 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

174 kB
Transfer

229 kB
Size

1
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!