urlscan.io logo urlscan.io
SecurityTrails logo

insuranceportal.av.qs.online-insure.com Open in urlscan Pro
104.111.241.222  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://barclays.co.uk/mypolicy
Effective URL: https://insuranceportal.av.qs.online-insure.com/portal/logon
Submission: On October 05 via manual from GB — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 1 HTTP transactions. The main IP is 104.111.241.222, located in Frankfurt am Main, Germany and belongs to AKAMAI-AS, US. The main domain is insuranceportal.av.qs.online-insure.com.
TLS certificate: Issued by Sectigo RSA Extended Validation Secur... on July 28th 2021. Valid for: 7 months.
This is the only time insuranceportal.av.qs.online-insure.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Barclays (Banking)

Domain & IP information

IP Address AS Autonomous System
3 3 104.111.241.154 16625 (AKAMAI-AS)
1 104.111.241.222 16625 (AKAMAI-AS)
1 2
Domain Requested by
2 barclays.co.uk 2 redirects
1 insuranceportal.av.qs.online-insure.com
1 www.barclays.co.uk 1 redirects
1 3

This site contains no links.

Subject Issuer Validity Valid
cert02.uk.aviva.com
Sectigo RSA Extended Validation Secure Server CA		 2021-07-28 -
2022-02-10		 7 months crt.sh

This page contains 1 frames:

Primary Page: https://insuranceportal.av.qs.online-insure.com/portal/logon
Frame ID: 40F1BD04110F73A3FA8D6D0BF83C7625
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Barclays home insurance - We're sorry

Page URL History Show full URLs

  1. http://barclays.co.uk/mypolicy HTTP 301
    https://barclays.co.uk/mypolicy HTTP 301
    https://www.barclays.co.uk/mypolicy HTTP 301
    https://insuranceportal.av.qs.online-insure.com/portal/logon Page URL

Detected technologies

Overall confidence: 100%
Detected patterns

Page Statistics

1
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

2
IPs

1
Countries

176 kB
Transfer

181 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://barclays.co.uk/mypolicy HTTP 301
    https://barclays.co.uk/mypolicy HTTP 301
    https://www.barclays.co.uk/mypolicy HTTP 301
    https://insuranceportal.av.qs.online-insure.com/portal/logon Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

1 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request logon
insuranceportal.av.qs.online-insure.com/portal/
Redirect Chain
  • http://barclays.co.uk/mypolicy
  • https://barclays.co.uk/mypolicy
  • https://www.barclays.co.uk/mypolicy
  • https://insuranceportal.av.qs.online-insure.com/portal/logon
153 KB
154 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://insuranceportal.av.qs.online-insure.com/portal/logon
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.241.222 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-241-222.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
5ab588916f1e388db2e032fd3095630493e298a82abc2d66cf681ea29a5536a2

Request headers

:method
GET
:authority
insuranceportal.av.qs.online-insure.com
:scheme
https
:path
/portal/logon
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
content-type
text/html
etag
"0cf28b5b4dbbbd2491d15e05c33ff32c:1559224591.488618"
last-modified
Thu, 30 May 2019 13:56:31 GMT
server
AkamaiNetStorage
content-length
156832
expires
Tue, 05 Oct 2021 14:33:46 GMT
cache-control
max-age=0, no-cache, no-store
pragma
no-cache
date
Tue, 05 Oct 2021 14:33:46 GMT
set-cookie
AKCOOKIE02=barclays-error; expires=Tue, 05-Oct-2021 14:38:46 GMT; path=/; domain=.insuranceportal.av.qs.online-insure.com; secure
reason
2

Redirect headers

content-type
text/html; charset=iso-8859-1
content-length
268
x-dispatcher
dispatcher1euwest1
x-vhost
publish
access-control-max-age
1000
access-control-allow-headers
x-xsrf-token, x-bandid, ajax-token, X-Requested-With, Content-Type, Origin, Authorization, Accept, Client-Security-Token, Accept-Encoding
access-control-allow-methods
GET,OPTIONS,HEAD
location
https://insuranceportal.av.qs.online-insure.com/portal/logon
cache-control
max-age=1800
expires
Tue, 05 Oct 2021 15:03:45 GMT
date
Tue, 05 Oct 2021 14:33:45 GMT
set-cookie
AWSALB=WfDWy0SE2XNpV2YQg75vxjuT6YCz+51f0K4p/f9T70ZT8PKH1o2PTm3VhxlJdT4Zbh96EntShJFFfCSkeEKGAasxa3jjzR0bpt3WCdD4i4/mULNi307HAI19+0p5; Expires=Tue, 12 Oct 2021 14:33:45 GMT; Path=/ AWSALBCORS=WfDWy0SE2XNpV2YQg75vxjuT6YCz+51f0K4p/f9T70ZT8PKH1o2PTm3VhxlJdT4Zbh96EntShJFFfCSkeEKGAasxa3jjzR0bpt3WCdD4i4/mULNi307HAI19+0p5; Expires=Tue, 12 Oct 2021 14:33:45 GMT; Path=/; SameSite=None; Secure ak_bmsc=39C1311025F9381C7BC93FF680FFCC3B~000000000000000000000000000000~YAAQNbsQAoCIKi58AQAA4u/fUA0sBJ44SuWoHhZ4/8j4I9wvo7iwx0BuORugLV4DqR7MY0OK+O3ty9c4GKppMxJ5bXj28c0x5mtiPsl0566Om+JToQglmZY2zhg2RfCcXpAFu/ejnys3JCHJ2bdiylF90ou7QToDiwIWEN4D44vOgZD59ba66HWji8xET4ZR58daIi5e7gIfaBEPWEI9jCoX4In+67l4AvrCTGfBfnU4d9IFoHqVHHTvwtserijGTeKApVg3NAEmxrXSYspDX9Z/c9+aBLjQpnA9jxckag0rPGqeqewW9baN0l/IrnVnd4gKF1X5rUHyzdPp8HJjubOTbAOUXewVz8pvrzLHgkUXs/Zsb5gKjRTFr6Hg/FmpeuU4ZppGhhooCOy0/c9M; Domain=.barclays.co.uk; Path=/; Expires=Tue, 05 Oct 2021 16:33:45 GMT; Max-Age=7200; HttpOnly
content-security-policy
default-src 'none'; connect-src 'self' formsdss-v3.uk.barclays bclays-ads.aimatch.com search.barclays.co.uk collect.tealiumiq.com *.akamaihd.net *.akstat.io beacon.krxd.net c.go-mpulse.net jslog.krxd.net www.media.barclays.co.uk device.4seeresults.com dpm.demdex.net barclaysbankplc.tt.omtrdc.net; font-src 'self' data: fonts.gstatic.com www.media.barclays.co.uk; frame-src demo.barclays.co.uk edigitalsurvey.com cdn.krxd.net www.google.com www.media.barclays.co.uk; child-src demo.barclays.co.uk edigitalsurvey.com cdn.krxd.net www.google.com www.media.barclays.co.uk; img-src 'self' data: demo.barclays.co.uk collect.tealiumiq.com cdnjs.cloudflare.com adservice.google.co.uk ad.doubleclick.net adservice.google.com apiservices.krxd.net beacon.krxd.net googleads.g.doubleclick.net googleads4.g.doubleclick.net jslog.krxd.net smetrics.barclays.co.uk www.facebook.com www.google.co.uk www.google.com maps.googleapis.com maps.google.com www.google.fr adservice.google.fr www.google.de www.google.es adservice.google.es www.google.nl www.google.se www.google.co.id www.google.co.il www.google.be www.google.sk www.google.co.nz www.google.co.za www.google.com.sg www.google.pt www.google.ca www.google.cz www.google.com.cy www.google.com.au adservice.google.com.au www.google.mk www.google.je adservice.google.je www.google.co.ug www.google.com.hk www.google.ro www.google.bg www.google.im www.google.co.ao www.google.ie adservice.google.ie www.google.com.ng www.google.it adservice.google.it www.google.lt www.google.ae www.google.gr www.google.com.mx www.google.hu www.google.ch www.google.ru www.google.com.eg www.google.com.pk www.google.com.bh www.google.pl adservice.google.pl www.google.co.in www.gstatic.com www.google-analytics.com www.google.lu www.google.co.jp www.google.com.tr adservice.google.co.il adservice.google.co.zw adservice.google.com.sa adservice.google.ae adservice.google.pt www.google.com.my adservice.google.nl www.google.gg adservice.google.be adservice.google.cz www.google.co.th adservice.google.de www.google.com.gh www.google.com.sa www.google.ge www.google.com.br www.google.com.tw www.google.dk www.google.com.ph adservice.google.co.za www.google.lv adservice.google.gg adservice.google.ca www.google.at www.google.rs www.google.com.mt adservice.google.com.hk www.google.no www.google.com.qa www.google.co.ke www.barclays.co.uk adservice.google.gr www.google.fi adservice.google.co.jp adservice.google.co.in www.google.com.vc www.google.lk adservice.google.ch www.google.com.ua www.google.az www.google.by www.google.com.kw adservice.google.com.sg adservice.google.im adservice.google.no www.google.co.zw www.google.mu www.google.com.vn adservice.google.com.br adservice.google.lv adservice.google.com.kw adservice.google.com.tr www.google.co.kr adservice.google.az adservice.google.hu adservice.google.co.th www.google.cm www.google.mw www.google.com.ar www.google.co.ma www.google.com.gi www.google.co.tz www.google.com.om www.google.com.af adservice.google.lt adservice.google.co.nz www.google.tt www.google.ms adservice.google.ro www.google.dz adservice.google.com.my www.google.com.pe www.google.com.jm www.google.com.sl adservice.google.com.cy adservice.google.se www.google.com.ec www.google.hr www.google.al adservice.google.ru www.google.co.mz adservice.google.com.ng www.google.com.et www.google.com.bn www.google.sh www.google.com.pa www.google.ci www.google.cl adservice.google.bg www.google.co.ve www.google.bs www.google.com.ag www.google.hn adservice.google.hn www.google.iq www.google.so www.google.com.np maps.gstatic.com www.media.barclays.co.uk 5452834.fls.doubleclick.net dev.day.com pixel.quantserve.com bclays-ads.aimatch.com; media-src 'self' demo.barclays.co.uk www.media.barclays.co.uk; script-src 'self' 'unsafe-eval' 'unsafe-inline' tags.tiqcdn.com collect.tealiumiq.com beacon.krxd.net cdn.krxd.net consumer.krxd.net gateway.answerscloud.com s.go-mpulse.net www.media.barclays.co.uk maps.googleapis.com www.google.com www.gstatic.com api.travelex.net resources.barclays.co.uk barclaysbankplc.tt.omtrdc.net; style-src 'self' 'unsafe-inline' www.media.barclays.co.uk fonts.googleapis.com; frame-ancestors 'self' https://*.barclays.co.uk https://*.uk.barclays; object-src 'self'; manifest-src 'self'; base-uri 'self';
x-frame-options
SAMEORIGIN
x-xss-protection
1;mode=block
strict-transport-security
max-age=63072000
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
91a06213190743f440aa3411f1393afaf3de8b3b6309d6677fb7680248f09e91

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e111be4c24fc0743ca7eb1c4873a64bb234135b9bea86cabd922a5caabb6c9c6

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		744 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e6d17982df9ed3f0ee18d928efa963da64fa62d3ddfaf0f5126c5493c5d2494f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		553 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
fe57ef1ff2d137e5a719a91b6f083084288925ffbe04aabba1e827d77ed5bf2d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		22 KB
22 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f56f823e0bd75388778cbccca78bcf7453c2c03c889274da7b47eebbc37b86b5

Request headers

Referer
Origin
https://insuranceportal.av.qs.online-insure.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type
application/x-font-woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Barclays (Banking)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect boolean| originAgentCluster

4 Cookies

Domain/Path Name / Value
www.barclays.co.uk/ Name: AWSALB
Value: WfDWy0SE2XNpV2YQg75vxjuT6YCz+51f0K4p/f9T70ZT8PKH1o2PTm3VhxlJdT4Zbh96EntShJFFfCSkeEKGAasxa3jjzR0bpt3WCdD4i4/mULNi307HAI19+0p5
www.barclays.co.uk/ Name: AWSALBCORS
Value: WfDWy0SE2XNpV2YQg75vxjuT6YCz+51f0K4p/f9T70ZT8PKH1o2PTm3VhxlJdT4Zbh96EntShJFFfCSkeEKGAasxa3jjzR0bpt3WCdD4i4/mULNi307HAI19+0p5
.barclays.co.uk/ Name: ak_bmsc
Value: 39C1311025F9381C7BC93FF680FFCC3B~000000000000000000000000000000~YAAQNbsQAoCIKi58AQAA4u/fUA0sBJ44SuWoHhZ4/8j4I9wvo7iwx0BuORugLV4DqR7MY0OK+O3ty9c4GKppMxJ5bXj28c0x5mtiPsl0566Om+JToQglmZY2zhg2RfCcXpAFu/ejnys3JCHJ2bdiylF90ou7QToDiwIWEN4D44vOgZD59ba66HWji8xET4ZR58daIi5e7gIfaBEPWEI9jCoX4In+67l4AvrCTGfBfnU4d9IFoHqVHHTvwtserijGTeKApVg3NAEmxrXSYspDX9Z/c9+aBLjQpnA9jxckag0rPGqeqewW9baN0l/IrnVnd4gKF1X5rUHyzdPp8HJjubOTbAOUXewVz8pvrzLHgkUXs/Zsb5gKjRTFr6Hg/FmpeuU4ZppGhhooCOy0/c9M
.insuranceportal.av.qs.online-insure.com/ Name: AKCOOKIE02
Value: barclays-error

1 Console Messages

Source Level URL
Text
network error URL: https://insuranceportal.av.qs.online-insure.com/portal/logon
Message:
Failed to load resource: the server responded with a status of 503 ()