web86.secure-secure.co.uk Open in urlscan Pro
79.170.44.86  Malicious Activity! Public Scan

URL: https://web86.secure-secure.co.uk/arelkatombb.co.uk/shark/memoredum/
Submission: On April 17 via manual from US — Scanned from US

Summary

This website contacted 4 IPs in 3 countries across 3 domains to perform 4 HTTP transactions. The main IP is 79.170.44.86, located in Leeds, United Kingdom and belongs to GD-EMEA-DC-LD5 Heart Internet limited, GB. The main domain is web86.secure-secure.co.uk.
TLS certificate: Issued by RapidSSL TLS RSA CA G1 on February 26th 2025. Valid for: a year.
This is the only time web86.secure-secure.co.uk was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: American Express (Financial)

Domain & IP information

IP Address AS Autonomous System
2 79.170.44.86 20738 (GD-EMEA-D...)
1 195.80.159.133 29152 (DECKNET-A...)
1 104.17.25.14 13335 (CLOUDFLAR...)
4 4
Apex Domain
Subdomains
Transfer
2 secure-secure.co.uk
web86.secure-secure.co.uk
2 MB
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 236
6 KB
1 l2.io
l2.io — Cisco Umbrella Rank: 212118
228 B
4 3
Domain Requested by
2 web86.secure-secure.co.uk
1 cdnjs.cloudflare.com web86.secure-secure.co.uk
1 l2.io web86.secure-secure.co.uk
4 3
Subject Issuer Validity Valid
*.secure-secure.co.uk
RapidSSL TLS RSA CA G1
2025-02-26 -
2026-03-29
a year crt.sh
l2.io
R10
2025-03-01 -
2025-05-30
3 months crt.sh
cdnjs.cloudflare.com
WE1
2025-03-24 -
2025-06-22
3 months crt.sh

This page contains 1 frames:

Primary Page: https://web86.secure-secure.co.uk/arelkatombb.co.uk/shark/memoredum/
Frame ID: E9E9E0196DD28C646F8ADE4ABF299AFE
Requests: 20 HTTP requests in this frame

Screenshot

Page Title

Log In to My Account | American Express US

Detected technologies

Overall confidence: 100%
Detected patterns
  • <[^>]+data-react

Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Page Statistics

4
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

2278 kB
Transfer

2342 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
web86.secure-secure.co.uk/arelkatombb.co.uk/shark/memoredum/
2 MB
2 MB
Document
General
Full URL
https://web86.secure-secure.co.uk/arelkatombb.co.uk/shark/memoredum/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
79.170.44.86 Leeds, United Kingdom, ASN20738 (GD-EMEA-DC-LD5 Heart Internet limited, GB),
Reverse DNS
web86.extendcp.co.uk
Software
Apache /
Resource Hash
7614c1cc97e3de3c267fb17d8fd11c023959493c429157ec5457763bb2130059

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
content-length
1944427
content-type
text/html
date
Thu, 17 Apr 2025 15:10:01 GMT
etag
"1dab6b-632bcc5ab7f28"
last-modified
Mon, 14 Apr 2025 13:10:11 GMT
server
Apache
truncated
/
75 KB
75 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7ef974010abfe71fb92dc3f53e3948e1e544cf6821bf9802ea0bf35fa8fe5af6

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Origin
https://web86.secure-secure.co.uk
Referer

Response headers

Content-Type
font/woff
ip.js
l2.io/
24 B
228 B
Script
General
Full URL
https://l2.io/ip.js?var=userip
Requested by
Host: web86.secure-secure.co.uk
URL: https://web86.secure-secure.co.uk/arelkatombb.co.uk/shark/memoredum/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
195.80.159.133 , France, ASN29152 (DECKNET-AS Decknet SARL, FR),
Reverse DNS
Software
Apache/2.4.59 (Debian) /
Resource Hash
d269e354b837bc82e4276646c46b52664f99ecc35ce84b0fe7cfcb95ebc774ab

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer
https://web86.secure-secure.co.uk/

Response headers

Keep-Alive
timeout=5, max=100
Content-Length
24
Date
Thu, 17 Apr 2025 15:10:02 GMT
Content-Type
text/html; charset=UTF-8
Server
Apache/2.4.59 (Debian)
Connection
Keep-Alive
font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/
30 KB
6 KB
Stylesheet
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
Requested by
Host: web86.secure-secure.co.uk
URL: https://web86.secure-secure.co.uk/arelkatombb.co.uk/shark/memoredum/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer
https://web86.secure-secure.co.uk/

Response headers

cf-cdnjs-via
cfworker/kv
content-encoding
br
cf-cache-status
HIT
etag
"5eb03e5f-7918"
age
673360
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1fzgA3UJowlMo9%2Fav4D%2F%2BNagbF8L1Wp0aBy3k5ZOfLGU5CL8KFXmLrFUaVutwCszZQazh4OG8%2BtzJjJFkwC%2BxoqlPMmCsZhFS6VLGh%2FUoMm6YI4FRJdIprKZEG2zwrqbmGJcSZX%2F"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Tue, 07 Apr 2026 15:10:02 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Thu, 17 Apr 2025 15:10:02 GMT
content-type
text/css; charset=utf-8
last-modified
Mon, 04 May 2020 16:10:07 GMT
vary
Accept-Encoding
priority
u=0,i=?0
strict-transport-security
max-age=15780000
cache-control
public, max-age=30672000
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
931cd8d00fbc15a6-SJC
accept-ranges
bytes
access-control-allow-origin
*
content-length
5631
server
cloudflare
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
028f643755987211bf2f3add6c62ae1870a888cf2f4fe3040a4fac7dce2543ab

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
truncated
/
5 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5e60a20da0f769a6260d4ed755d615da930b87c62436f807a6ff32d000017d18

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c39e8554624a4b74e596d2bfa96bdd4d30dbc395532ab32e67591c0e929080e9

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
truncated
/
20 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
083b24a80c37b4f60fb49ee09c7eb5fbd536298b24606d0a0471dfe2251a5ee1

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/jpeg
truncated
/
44 KB
44 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6c2307e5fa4f3725b00710176eeab8c23abbcd4acfd6f7c70389acc9d08d82f0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Origin
https://web86.secure-secure.co.uk
Referer

Response headers

Content-Type
font/woff
truncated
/
36 KB
36 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
48050d8eeb740bb31aaad9eb82bcd4a493b474c9385eeda5fc2ca2ea279cffad

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Origin
https://web86.secure-secure.co.uk
Referer

Response headers

Content-Type
font/woff
truncated
/
34 KB
34 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3ab0045c7cec2bd10b33c094d7ff82145efe1e75345bc49166dc5236db831b08

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Origin
https://web86.secure-secure.co.uk
Referer

Response headers

Content-Type
font/woff
truncated
/
71 KB
71 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d5d7822393d3103ec421f72f09c7f7c78948c68da112031c0afd1c0b0da92c08

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Origin
https://web86.secure-secure.co.uk
Referer

Response headers

Content-Type
font/woff
truncated
/
39 KB
39 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
80239f6b5f0ac5edc4a589c5bba51392f015dddf3c2d7ba9ce922058d63d8ec2

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Origin
https://web86.secure-secure.co.uk
Referer

Response headers

Content-Type
font/woff
truncated
/
644 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
428a13dcd90b9a52dac690a578092e1b24e6121952668d4bcf001a6287c880dd

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
truncated
/
1 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
677a6a5da6f0e85f66c5232fc39ffd285ed010a9498c40cdd7e56d2ff0b7e7da

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
truncated
/
8 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c000ce3efd67b43d573f0270ec30bb3854908f0672a8e08a6809a3680b7b8542

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
truncated
/
764 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5c5381a437e62da458e251201a5c46af59e750b8f40470b77d00ce9fcf08fc6b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
truncated
/
984 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5cb5e693ba5e56c274a113f77c50becb662d18324b2ed681432f60ee4761de3d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
truncated
/
72 KB
72 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e9f9fab2d479b79aca1d3d3bf0a9fc36131752869363180bef040905a008cc1b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Origin
https://web86.secure-secure.co.uk
Referer

Response headers

Content-Type
font/woff
favicon.ico
web86.secure-secure.co.uk/
271 B
374 B
Other
General
Full URL
https://web86.secure-secure.co.uk/favicon.ico
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
79.170.44.86 Leeds, United Kingdom, ASN20738 (GD-EMEA-DC-LD5 Heart Internet limited, GB),
Reverse DNS
web86.extendcp.co.uk
Software
Apache /
Resource Hash
f05d6e7615822a078240545fa7ecc617a6609c44091829d658be78e81d9373d7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer
https://web86.secure-secure.co.uk/arelkatombb.co.uk/shark/memoredum/

Response headers

content-length
271
date
Thu, 17 Apr 2025 15:10:03 GMT
content-type
text/html; charset=iso-8859-1
server
Apache

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: American Express (Financial)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 function| savepage_ShadowLoader string| userip function| isNumber

0 Cookies

8 Console Messages

Source Level URL
Text
recommendation warning URL: https://web86.secure-secure.co.uk/arelkatombb.co.uk/shark/memoredum/
Message:
[DOM] Found 2 elements with non-unique id #eliloSelect: (More info: https://goo.gl/9p2vKq) %o %o
recommendation warning URL: https://web86.secure-secure.co.uk/arelkatombb.co.uk/shark/memoredum/
Message:
[DOM] Found 6 elements with non-unique id #loginSubmit: (More info: https://goo.gl/9p2vKq) %o %o %o %o %o %o
recommendation warning URL: https://web86.secure-secure.co.uk/arelkatombb.co.uk/shark/memoredum/
Message:
[DOM] Found 2 elements with non-unique id #rememberMe: (More info: https://goo.gl/9p2vKq) %o %o
recommendation verbose URL: https://web86.secure-secure.co.uk/arelkatombb.co.uk/shark/memoredum/
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
recommendation verbose URL: https://web86.secure-secure.co.uk/arelkatombb.co.uk/shark/memoredum/
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
recommendation verbose URL: https://web86.secure-secure.co.uk/arelkatombb.co.uk/shark/memoredum/
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
recommendation verbose URL: https://web86.secure-secure.co.uk/arelkatombb.co.uk/shark/memoredum/
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
network error URL: https://web86.secure-secure.co.uk/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
l2.io
web86.secure-secure.co.uk
104.17.25.14
195.80.159.133
79.170.44.86
028f643755987211bf2f3add6c62ae1870a888cf2f4fe3040a4fac7dce2543ab
083b24a80c37b4f60fb49ee09c7eb5fbd536298b24606d0a0471dfe2251a5ee1
3ab0045c7cec2bd10b33c094d7ff82145efe1e75345bc49166dc5236db831b08
428a13dcd90b9a52dac690a578092e1b24e6121952668d4bcf001a6287c880dd
48050d8eeb740bb31aaad9eb82bcd4a493b474c9385eeda5fc2ca2ea279cffad
5c5381a437e62da458e251201a5c46af59e750b8f40470b77d00ce9fcf08fc6b
5cb5e693ba5e56c274a113f77c50becb662d18324b2ed681432f60ee4761de3d
5e60a20da0f769a6260d4ed755d615da930b87c62436f807a6ff32d000017d18
677a6a5da6f0e85f66c5232fc39ffd285ed010a9498c40cdd7e56d2ff0b7e7da
6c2307e5fa4f3725b00710176eeab8c23abbcd4acfd6f7c70389acc9d08d82f0
7614c1cc97e3de3c267fb17d8fd11c023959493c429157ec5457763bb2130059
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7ef974010abfe71fb92dc3f53e3948e1e544cf6821bf9802ea0bf35fa8fe5af6
80239f6b5f0ac5edc4a589c5bba51392f015dddf3c2d7ba9ce922058d63d8ec2
c000ce3efd67b43d573f0270ec30bb3854908f0672a8e08a6809a3680b7b8542
c39e8554624a4b74e596d2bfa96bdd4d30dbc395532ab32e67591c0e929080e9
d269e354b837bc82e4276646c46b52664f99ecc35ce84b0fe7cfcb95ebc774ab
d5d7822393d3103ec421f72f09c7f7c78948c68da112031c0afd1c0b0da92c08
e9f9fab2d479b79aca1d3d3bf0a9fc36131752869363180bef040905a008cc1b
f05d6e7615822a078240545fa7ecc617a6609c44091829d658be78e81d9373d7