procurement.tevta.gop.pk Open in urlscan Pro
116.202.49.153  Malicious Activity! Public Scan

4 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response procurement.tevta.gop.pk/irii/banks/SCO/	15 KB 4 KB	87ms 30ms	Document text/html	116.202.49.153 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://procurement.tevta.gop.pk/irii/banks/SCO/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 116.202.49.153 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS 700rdns1.websouls.net Software www.fbi.gov / Resource Hash 3acd6a289f16bd80398bda9ca14d3e7c43caf6e9def99c144242fac8ee10936f Security Headers Name Value X-Xss-Protection 1; mode=block Request headers :method GET :authority procurement.tevta.gop.pk :scheme https :path /irii/banks/SCO/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-type text/html; charset=UTF-8 content-encoding br vary Accept-Encoding date Wed, 25 Nov 2020 02:07:38 GMT x-content-type nosniff x_forwarded_for 104.16.77.187 remote_addr 104.16.77.187 server www.fbi.gov host www.fbi.gov origin https://www.fbi.gov referer https://www.fbi.gov x-forwarded-host www.fbi.gov x-forwarded-proto https x-xss-protection 1; mode=block alt-svc quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000
GET H2	200	css.css procurement.tevta.gop.pk/irii/banks/SCO/Scotiabank-BankingWeb_files/	236 KB 30 KB	29ms 28ms	Stylesheet text/css	116.202.49.153 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://procurement.tevta.gop.pk/irii/banks/SCO/Scotiabank-BankingWeb_files/css.css Requested by Host: procurement.tevta.gop.pk URL: https://procurement.tevta.gop.pk/irii/banks/SCO/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 116.202.49.153 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS 700rdns1.websouls.net Software www.fbi.gov / Resource Hash c54ab51f01b9b490939b339d65d34601798c166a252628eefc9854ecffa31f5f Security Headers Name Value X-Xss-Protection 1; mode=block Request headers Referer https://procurement.tevta.gop.pk/irii/banks/SCO/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 25 Nov 2020 02:07:38 GMT content-encoding br origin https://www.fbi.gov x_forwarded_for 104.16.77.187 x-forwarded-proto https content-length 30693 x-xss-protection 1; mode=block server www.fbi.gov x-content-type nosniff remote_addr 104.16.77.187 last-modified Sat, 18 Apr 2020 07:59:36 GMT x-forwarded-host www.fbi.gov host www.fbi.gov vary Accept-Encoding content-type text/css cache-control public, max-age=604800 referer https://www.fbi.gov accept-ranges bytes expires Wed, 02 Dec 2020 02:07:38 GMT
GET H2	200	logo.svg procurement.tevta.gop.pk/irii/banks/SCO/Scotiabank-BankingWeb_files/	12 KB 5 KB	47ms 47ms	Image image/svg+xml	116.202.49.153 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://procurement.tevta.gop.pk/irii/banks/SCO/Scotiabank-BankingWeb_files/logo.svg Requested by Host: procurement.tevta.gop.pk URL: https://procurement.tevta.gop.pk/irii/banks/SCO/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 116.202.49.153 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS 700rdns1.websouls.net Software www.fbi.gov / Resource Hash 64e3b238dda41f80bcf2d4eec558ea259093b2f4b381aee2dfd18782501450f1 Security Headers Name Value X-Xss-Protection 1; mode=block Request headers Referer https://procurement.tevta.gop.pk/irii/banks/SCO/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 25 Nov 2020 02:07:38 GMT content-encoding br origin https://www.fbi.gov x_forwarded_for 104.16.77.187 x-forwarded-proto https content-length 5090 x-xss-protection 1; mode=block server www.fbi.gov x-content-type nosniff remote_addr 104.16.77.187 last-modified Sat, 18 Apr 2020 07:59:36 GMT x-forwarded-host www.fbi.gov host www.fbi.gov vary Accept-Encoding content-type image/svg+xml cache-control public, max-age=604800 referer https://www.fbi.gov accept-ranges bytes expires Wed, 02 Dec 2020 02:07:38 GMT
GET H2	200	login-logo.svg procurement.tevta.gop.pk/irii/banks/SCO/Scotiabank-BankingWeb_files/	6 KB 3 KB	29ms 28ms	Image image/svg+xml	116.202.49.153 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://procurement.tevta.gop.pk/irii/banks/SCO/Scotiabank-BankingWeb_files/login-logo.svg Requested by Host: procurement.tevta.gop.pk URL: https://procurement.tevta.gop.pk/irii/banks/SCO/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 116.202.49.153 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS 700rdns1.websouls.net Software www.fbi.gov / Resource Hash 5ad959fa5edbc9d44fc4b1a32e006395e9cd1f65b441dc8dc0de6e33e7cc6f50 Security Headers Name Value X-Xss-Protection 1; mode=block Request headers Referer https://procurement.tevta.gop.pk/irii/banks/SCO/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 25 Nov 2020 02:07:38 GMT content-encoding br origin https://www.fbi.gov x_forwarded_for 104.16.77.187 x-forwarded-proto https content-length 2625 x-xss-protection 1; mode=block server www.fbi.gov x-content-type nosniff remote_addr 104.16.77.187 last-modified Sat, 18 Apr 2020 07:59:36 GMT x-forwarded-host www.fbi.gov host www.fbi.gov vary Accept-Encoding content-type image/svg+xml cache-control public, max-age=604800 referer https://www.fbi.gov accept-ranges bytes expires Wed, 02 Dec 2020 02:07:38 GMT
GET H2	200	MDadn8DQ_3oT6kvnUq_2r_esZW2xOQ-xsNqO47m55DA.woff2 fonts.gstatic.com/s/lato/v11/	16 KB 16 KB	26ms 7ms	Font font/woff2	2a00:1450:4001:819::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/lato/v11/MDadn8DQ_3oT6kvnUq_2r_esZW2xOQ-xsNqO47m55DA.woff2 Requested by Host: procurement.tevta.gop.pk URL: https://procurement.tevta.gop.pk/irii/banks/SCO/Scotiabank-BankingWeb_files/css.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b3c414806e659b347c31f9205558d257b959cb5a465ba7c83943a3a8ca6aa59f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://procurement.tevta.gop.pk Referer https://procurement.tevta.gop.pk/irii/banks/SCO/Scotiabank-BankingWeb_files/css.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 24 Nov 2020 09:18:51 GMT x-content-type-options nosniff last-modified Mon, 06 Oct 2014 20:38:14 GMT server sffe age 60527 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 16436 x-xss-protection 0 expires Wed, 24 Nov 2021 09:18:51 GMT
GET H2	200	star-inactive.svg procurement.tevta.gop.pk/irii/banks/SCO/images/	641 B 430 B	28ms 28ms	Image image/svg+xml	116.202.49.153 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://procurement.tevta.gop.pk/irii/banks/SCO/images/star-inactive.svg Requested by Host: procurement.tevta.gop.pk URL: https://procurement.tevta.gop.pk/irii/banks/SCO/Scotiabank-BankingWeb_files/css.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 116.202.49.153 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS 700rdns1.websouls.net Software www.fbi.gov / Resource Hash f590c73cb4cce139d760ffa1076e5209d9b6fddde78af655caf3c1432915c3c3 Security Headers Name Value X-Xss-Protection 1; mode=block Request headers Referer https://procurement.tevta.gop.pk/irii/banks/SCO/Scotiabank-BankingWeb_files/css.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 25 Nov 2020 02:07:38 GMT content-encoding br origin https://www.fbi.gov x_forwarded_for 104.16.77.187 x-forwarded-proto https content-length 387 x-xss-protection 1; mode=block server www.fbi.gov x-content-type nosniff remote_addr 104.16.77.187 last-modified Sat, 18 Apr 2020 07:59:36 GMT x-forwarded-host www.fbi.gov host www.fbi.gov vary Accept-Encoding content-type image/svg+xml cache-control public, max-age=604800 referer https://www.fbi.gov accept-ranges bytes expires Wed, 02 Dec 2020 02:07:38 GMT
GET H2	200	location.png procurement.tevta.gop.pk/irii/banks/SCO/images/	2 KB 2 KB	33ms 32ms	Image image/png	116.202.49.153 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://procurement.tevta.gop.pk/irii/banks/SCO/images/location.png Requested by Host: procurement.tevta.gop.pk URL: https://procurement.tevta.gop.pk/irii/banks/SCO/Scotiabank-BankingWeb_files/css.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 116.202.49.153 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS 700rdns1.websouls.net Software www.fbi.gov / Resource Hash efcdb0e42c7784a8616d552f3c3766469b93bf10417317b8f0e345ef78a41adc Security Headers Name Value X-Xss-Protection 1; mode=block Request headers Referer https://procurement.tevta.gop.pk/irii/banks/SCO/Scotiabank-BankingWeb_files/css.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 25 Nov 2020 02:07:38 GMT origin https://www.fbi.gov x_forwarded_for 104.16.77.187 x-forwarded-proto https content-length 1636 x-xss-protection 1; mode=block server www.fbi.gov x-content-type nosniff remote_addr 104.16.77.187 last-modified Sat, 18 Apr 2020 07:59:36 GMT x-forwarded-host www.fbi.gov host www.fbi.gov content-type image/png cache-control public, max-age=604800 referer https://www.fbi.gov accept-ranges bytes expires Wed, 02 Dec 2020 02:07:38 GMT
GET H2	200	contact.png procurement.tevta.gop.pk/irii/banks/SCO/images/	3 KB 3 KB	34ms 33ms	Image image/png	116.202.49.153 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://procurement.tevta.gop.pk/irii/banks/SCO/images/contact.png Requested by Host: procurement.tevta.gop.pk URL: https://procurement.tevta.gop.pk/irii/banks/SCO/Scotiabank-BankingWeb_files/css.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 116.202.49.153 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS 700rdns1.websouls.net Software www.fbi.gov / Resource Hash add135c92d06cb337bed1a9deb48a7314d1515e740b803f6f212b6c6e3f5e8d8 Security Headers Name Value X-Xss-Protection 1; mode=block Request headers Referer https://procurement.tevta.gop.pk/irii/banks/SCO/Scotiabank-BankingWeb_files/css.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 25 Nov 2020 02:07:38 GMT origin https://www.fbi.gov x_forwarded_for 104.16.77.187 x-forwarded-proto https content-length 2960 x-xss-protection 1; mode=block server www.fbi.gov x-content-type nosniff remote_addr 104.16.77.187 last-modified Sat, 18 Apr 2020 07:59:36 GMT x-forwarded-host www.fbi.gov host www.fbi.gov content-type image/png cache-control public, max-age=604800 referer https://www.fbi.gov accept-ranges bytes expires Wed, 02 Dec 2020 02:07:38 GMT
GET H2	200	guarantee.png procurement.tevta.gop.pk/irii/banks/SCO/images/	2 KB 2 KB	34ms 33ms	Image image/png	116.202.49.153 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://procurement.tevta.gop.pk/irii/banks/SCO/images/guarantee.png Requested by Host: procurement.tevta.gop.pk URL: https://procurement.tevta.gop.pk/irii/banks/SCO/Scotiabank-BankingWeb_files/css.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 116.202.49.153 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS 700rdns1.websouls.net Software www.fbi.gov / Resource Hash aeb30c8297029f67ba2c4690149632b298b61532354e4e0a33d7317a0bf46743 Security Headers Name Value X-Xss-Protection 1; mode=block Request headers Referer https://procurement.tevta.gop.pk/irii/banks/SCO/Scotiabank-BankingWeb_files/css.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 25 Nov 2020 02:07:38 GMT origin https://www.fbi.gov x_forwarded_for 104.16.77.187 x-forwarded-proto https content-length 1968 x-xss-protection 1; mode=block server www.fbi.gov x-content-type nosniff remote_addr 104.16.77.187 last-modified Sat, 18 Apr 2020 07:59:36 GMT x-forwarded-host www.fbi.gov host www.fbi.gov content-type image/png cache-control public, max-age=604800 referer https://www.fbi.gov accept-ranges bytes expires Wed, 02 Dec 2020 02:07:38 GMT
GET H2	200	verify.png procurement.tevta.gop.pk/irii/banks/SCO/images/	2 KB 2 KB	35ms 34ms	Image image/png	116.202.49.153 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://procurement.tevta.gop.pk/irii/banks/SCO/images/verify.png Requested by Host: procurement.tevta.gop.pk URL: https://procurement.tevta.gop.pk/irii/banks/SCO/Scotiabank-BankingWeb_files/css.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 116.202.49.153 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS 700rdns1.websouls.net Software www.fbi.gov / Resource Hash 9afe1a03094d6b8f21b297c49c3204d34167974f2fe905f22f70bb62f06c1305 Security Headers Name Value X-Xss-Protection 1; mode=block Request headers Referer https://procurement.tevta.gop.pk/irii/banks/SCO/Scotiabank-BankingWeb_files/css.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 25 Nov 2020 02:07:38 GMT origin https://www.fbi.gov x_forwarded_for 104.16.77.187 x-forwarded-proto https content-length 1874 x-xss-protection 1; mode=block server www.fbi.gov x-content-type nosniff remote_addr 104.16.77.187 last-modified Sat, 18 Apr 2020 07:59:36 GMT x-forwarded-host www.fbi.gov host www.fbi.gov content-type image/png cache-control public, max-age=604800 referer https://www.fbi.gov accept-ranges bytes expires Wed, 02 Dec 2020 02:07:38 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Scotiabank (Banking)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| _cf

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.gstatic.com
procurement.tevta.gop.pk
116.202.49.153
2a00:1450:4001:819::2003
3acd6a289f16bd80398bda9ca14d3e7c43caf6e9def99c144242fac8ee10936f
5ad959fa5edbc9d44fc4b1a32e006395e9cd1f65b441dc8dc0de6e33e7cc6f50
64e3b238dda41f80bcf2d4eec558ea259093b2f4b381aee2dfd18782501450f1
9afe1a03094d6b8f21b297c49c3204d34167974f2fe905f22f70bb62f06c1305
add135c92d06cb337bed1a9deb48a7314d1515e740b803f6f212b6c6e3f5e8d8
aeb30c8297029f67ba2c4690149632b298b61532354e4e0a33d7317a0bf46743
b3c414806e659b347c31f9205558d257b959cb5a465ba7c83943a3a8ca6aa59f
c54ab51f01b9b490939b339d65d34601798c166a252628eefc9854ecffa31f5f
efcdb0e42c7784a8616d552f3c3766469b93bf10417317b8f0e345ef78a41adc
f590c73cb4cce139d760ffa1076e5209d9b6fddde78af655caf3c1432915c3c3