![](/screenshots/3c41778e-9be5-444f-aa1b-87b385fd3d7c.png)
axamedicalassessment.rockinsurance.com
Open in
urlscan Pro
2606:4700::6812:fd9
Malicious Activity!
Public Scan
Submission: On June 27 via manual from FR — Scanned from FR
Summary
TLS certificate: Issued by GTS CA 1P5 on May 13th 2024. Valid for: 3 months.
This is the only time axamedicalassessment.rockinsurance.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Axa (Insurance)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
14 | 2606:4700::68... 2606:4700::6812:fd9 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2a00:1450:400... 2a00:1450:4001:813::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2606:4700::68... 2606:4700::6810:5049 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2600:9000:249... 2600:9000:2490:c600:1f:5417:2880:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2600:9000:267... 2600:9000:2670:be00:9:429c:140:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2600:9000:235... 2600:9000:235a:fa00:f:6a9:200:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2600:9000:249... 2600:9000:2490:da00:1f:5417:2880:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
21 | 7 |
ASN13335 (CLOUDFLARENET, US)
axamedicalassessment.rockinsurance.com |
ASN16509 (AMAZON-02, US)
director.api.mitel.io |
ASN16509 (AMAZON-02, US)
gcp-gateway.eu.api.mitel.io |
Apex Domain Subdomains |
Transfer | |
---|---|---|
14 |
rockinsurance.com
axamedicalassessment.rockinsurance.com |
337 KB |
4 |
mitel.io
webchat.mitel.io — Cisco Umbrella Rank: 112065 director.api.mitel.io — Cisco Umbrella Rank: 123909 gcp-gateway.eu.api.mitel.io — Cisco Umbrella Rank: 351815 |
10 KB |
2 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 469 |
97 KB |
1 |
cloudflareinsights.com
static.cloudflareinsights.com — Cisco Umbrella Rank: 1073 |
7 KB |
21 | 4 |
Domain | Requested by | |
---|---|---|
14 | axamedicalassessment.rockinsurance.com |
axamedicalassessment.rockinsurance.com
static.cloudflareinsights.com |
2 | webchat.mitel.io |
axamedicalassessment.rockinsurance.com
webchat.mitel.io |
2 | ajax.googleapis.com |
axamedicalassessment.rockinsurance.com
|
1 | gcp-gateway.eu.api.mitel.io |
webchat.mitel.io
|
1 | director.api.mitel.io |
webchat.mitel.io
|
1 | static.cloudflareinsights.com |
axamedicalassessment.rockinsurance.com
|
21 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
rockinsurance.com GTS CA 1P5 |
2024-05-13 - 2024-08-11 |
3 months | crt.sh |
upload.video.google.com WR2 |
2024-06-13 - 2024-09-05 |
3 months | crt.sh |
cloudflareinsights.com GTS CA 1P5 |
2024-05-08 - 2024-08-06 |
3 months | crt.sh |
webchat.mitel.io Amazon RSA 2048 M02 |
2024-03-05 - 2025-04-03 |
a year | crt.sh |
*.api.mitel.io Amazon RSA 2048 M03 |
2024-04-07 - 2025-05-06 |
a year | crt.sh |
*.eu.api.mitel.io Amazon RSA 2048 M03 |
2024-02-08 - 2025-03-09 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://axamedicalassessment.rockinsurance.com/
Frame ID: D1B547847406228FB1AB5A6B5A578DDB
Requests: 20 HTTP requests in this frame
Frame:
https://webchat.mitel.io/?accountid=NGM5OGIyNTYtNWNkNC00NjExLTk2NjYtNzMzZjQwOTMyMTc3&chatname=QVhBIENvLW9wIENoYXQ=&chaturl=aHR0cHM6Ly9nY3AtZ2F0ZXdheS5ldS5hcGkubWl0ZWwuaW8vMjAxOC0wNS0yNy9tZXNzZW5nZXIvYWNjb3VudHMvNGM5OGIyNTYtNWNkNC00NjExLTk2NjYtNzMzZjQwOTMyMTc3L2NoYXRzP2NoYXRuYW1lPUFYQSBDby1vcCBDaGF0
Frame ID: B2728B09E456C5833239FD62682BBC6C
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/3c41778e-9be5-444f-aa1b-87b385fd3d7c.png)
Page Title
Home Page - The co-operative bankDetected technologies
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Detected patterns
- static\.cloudflareinsights\.com/beacon(?:\.min)?\.js
Detected patterns
- ([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Detected patterns
- ([\d.]+)/jquery-ui(?:\.min)?\.js
- jquery-ui.*\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
21 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
axamedicalassessment.rockinsurance.com/ |
5 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
axamedicalassessment.rockinsurance.com/Content/ |
157 KB 26 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
modernizr
axamedicalassessment.rockinsurance.com/bundles/ |
11 KB 4 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-ui.css
axamedicalassessment.rockinsurance.com/Content/ |
22 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Site.css
axamedicalassessment.rockinsurance.com/Content/ |
37 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
SiteScript.js
axamedicalassessment.rockinsurance.com/Scripts/ |
39 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.2.1/ |
85 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-ui.min.js
ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/ |
248 KB 66 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
homepage
axamedicalassessment.rockinsurance.com/bundles/ |
30 KB 8 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
axa_logo.svg
axamedicalassessment.rockinsurance.com/Images/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
coopbanner.jpg
axamedicalassessment.rockinsurance.com/Images/ |
184 KB 185 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery
axamedicalassessment.rockinsurance.com/bundles/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap
axamedicalassessment.rockinsurance.com/bundles/ |
51 KB 14 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vcd15cbe7772f49c399c6a5babf22c1241717689176015
static.cloudflareinsights.com/beacon.min.js/ |
19 KB 7 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrapper.js
webchat.mitel.io/ |
22 KB 7 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
CoopBank.ttf
axamedicalassessment.rockinsurance.com/fonts/ |
70 KB 70 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
4c98b256-5cd4-4611-9666-733f40932177
director.api.mitel.io/2018-07-01/whereami/ |
150 B 594 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
rum
axamedicalassessment.rockinsurance.com/cdn-cgi/ |
0 186 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
axamedicalassessment.rockinsurance.com/ |
31 KB 9 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chats
gcp-gateway.eu.api.mitel.io/2018-05-27/messenger/accounts/4c98b256-5cd4-4611-9666-733f40932177/ |
4 KB 2 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
webchat.mitel.io/ Frame B272 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Axa (Insurance)25 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 undefined| event object| fence object| sharedStorage object| html5 object| Modernizr function| addLoader function| VerifyUnderwriterDeclined function| DatePicker function| hideSameAddress function| ValidateTravellers function| SaveTraveller function| conditionsManager function| getQueryStringValue function| $ function| jQuery function| quotePopupHandler object| technologyObject object| bootstrap object| respond object| __cfBeacon object| MiCC_ChatData object| chatwin object| cacheTime boolean| load1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.rockinsurance.com/ | Name: __cf_bm Value: vsus6Qdwk_G9FgJYBQlAgM2bAAEI73khZmHoj5grC5U-1719496450-1.0.1.1-UU3hYFSV8g5SHjCmFL5b6pMcfjoVkLrZ0Ue8Q6VTbwmcfnv6s0IHtl2HDm8e7OnVNvfKslgQCyG8J1FdS7weUw |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
axamedicalassessment.rockinsurance.com
director.api.mitel.io
gcp-gateway.eu.api.mitel.io
static.cloudflareinsights.com
webchat.mitel.io
2600:9000:235a:fa00:f:6a9:200:93a1
2600:9000:2490:c600:1f:5417:2880:93a1
2600:9000:2490:da00:1f:5417:2880:93a1
2600:9000:2670:be00:9:429c:140:93a1
2606:4700::6810:5049
2606:4700::6812:fd9
2a00:1450:4001:813::200a
0ec4e0295f86b2142b8996e03d4195888843b50d1954d7e248341da032b7ebba
1363c0ccd09bba9a97f6291c53b34c3bcdcae9ab9c0d1d1d7373aa7a0e2a7372
13d32b63fa4346e3acfdf4548221b13d01c2d8a238b1879bd45c3b26a5f4eb4c
1c1b45131597b28c252c0b0c89fe4a00a76c67127cf6c6cfeec244600a697fc0
3c4b0cff23b97dc1343a8266390e00a4b99cfcec479c860d9d6a3858d88e8c7e
3d4b468a0575f7586e7aea75628a9c6d26d3c6ce3532a212c37138954e10354f
3d4df104b6aa10034fd8278508b32bdec8291a659c1bc5b881b44d6fb8834652
402ab8b21c32b5a32929ce8b3039e866ab5525eb72f57ecac1e50008765f3e8c
4f15551e8df16365a4eba91f078b16e4dc40959a98f6f8e1de8b2ad895ccc705
55021755ce7658de23ff637fe37d08f16f8f754df4d1df4e3a9749f5bd28658f
55accff7b642c2d7a402cbe03c1494c0f14a76bc03dee9d47d219562b6a152a5
684535330ed2cce0ccbafc7eef3ab721fd429388c059b49cb8fdc759497afd82
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
89014a32395d68835aac9669de641b949d0abce46011e1ba950b15c4540eb654
8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f
a94f8a8553caea8430dd4ca3cc01d4e318d19828f74cb65453ffb7f5d9e2f44d
d90f47e07b81f5d9b988797901b7595ce0de70b83e649783b5ff64b9064d313c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f1ad4ad4e439013fe514c6e4a7a787b24c2b076a0471e20f834833da973790f9