urlscan.io logo urlscan.io
SecurityTrails logo

wicklow.demschooltools.com Open in urlscan Pro
143.42.5.249  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://wicklow.demschooltools.com/
Effective URL: https://wicklow.demschooltools.com/login
Submission Tags: phishingrod
Submission: On February 01 via api from DE — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 5 HTTP transactions. The main IP is 143.42.5.249, located in Cedar Knolls, United States and belongs to AKAMAI-LINODE-AP Akamai Connected Cloud, SG. The main domain is wicklow.demschooltools.com.
TLS certificate: Issued by R3 on February 1st 2024. Valid for: 3 months.
This is the only time wicklow.demschooltools.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 5 143.42.5.249 63949 (AKAMAI-LI...)
1 18.154.63.11 16509 (AMAZON-02)
5 2
Apex Domain
Subdomains		 Transfer
5 demschooltools.com
wicklow.demschooltools.com
164 KB
1 rollbar.com
cdn.rollbar.com — Cisco Umbrella Rank: 10444
24 KB
5 2
Domain Requested by
5 wicklow.demschooltools.com 1 redirects wicklow.demschooltools.com
1 cdn.rollbar.com wicklow.demschooltools.com
5 2

This site contains links to these domains. Also see Links.

Domain
support.mozilla.org
support.apple.com
support.google.com
Subject Issuer Validity Valid
demschooltools.com
R3		 2024-02-01 -
2024-05-01		 3 months crt.sh
cdn.rollbar.com
Amazon RSA 2048 M02		 2023-05-12 -
2024-06-09		 a year crt.sh

This page contains 1 frames:

Primary Page: https://wicklow.demschooltools.com/login
Frame ID: 23D0BBFE161DAB739CF1CCFB8DE41846
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

DemSchoolTools login (WSS)

Page URL History Show full URLs

  1. https://wicklow.demschooltools.com/ HTTP 303
    https://wicklow.demschooltools.com/login Page URL

Page Statistics

5
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

188 kB
Transfer

662 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://wicklow.demschooltools.com/ HTTP 303
    https://wicklow.demschooltools.com/login Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request login
wicklow.demschooltools.com/
Redirect Chain
  • https://wicklow.demschooltools.com/
  • https://wicklow.demschooltools.com/login
11 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://wicklow.demschooltools.com/login
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
143.42.5.249 Cedar Knolls, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS
143-42-5-249.ip.linodeusercontent.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
6e8b2b32103d70f5f44d854b2d2ee67251932e40f62d4a36389d246b4b3b5cc7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Thu, 01 Feb 2024 22:10:33 GMT
Referrer-Policy
origin-when-cross-origin, strict-origin-when-cross-origin
Server
nginx/1.18.0 (Ubuntu)
Transfer-Encoding
chunked
X-Content-Type-Options
nosniff
X-Frame-Options
DENY
X-Permitted-Cross-Domain-Policies
master-only
X-XSS-Protection
1; mode=block

Redirect headers

Connection
keep-alive
Content-Length
0
Date
Thu, 01 Feb 2024 22:10:33 GMT
Location
/login
Referrer-Policy
origin-when-cross-origin, strict-origin-when-cross-origin
Server
nginx/1.18.0 (Ubuntu)
X-Content-Type-Options
nosniff
X-Frame-Options
DENY
X-Permitted-Cross-Domain-Policies
master-only
X-XSS-Protection
1; mode=block
bundle.js
wicklow.demschooltools.com/assets/javascripts/gen/ 		435 KB
131 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://wicklow.demschooltools.com/assets/javascripts/gen/bundle.js
Requested by
Host: wicklow.demschooltools.com
URL: https://wicklow.demschooltools.com/login
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
143.42.5.249 Cedar Knolls, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS
143-42-5-249.ip.linodeusercontent.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
70a48085accb417bb83b82b5a13bc0257b6856f081798561fec81e28bc2a9775
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wicklow.demschooltools.com/login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date
Thu, 01 Feb 2024 22:10:33 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
X-Permitted-Cross-Domain-Policies
master-only
Connection
keep-alive
Content-Length
133441
X-XSS-Protection
1; mode=block
Referrer-Policy
origin-when-cross-origin, strict-origin-when-cross-origin
Last-Modified
Fri, 01 Jan 2010 00:00:00 GMT
Server
nginx/1.18.0 (Ubuntu)
ETag
"4d34f7db48bc24b6bb8c7f3c6069ceae"
Vary
Accept-Encoding
X-Frame-Options
DENY
Content-Type
application/javascript; charset=UTF-8
Cache-Control
public, max-age=3600
Accept-Ranges
bytes
main.css
wicklow.demschooltools.com/assets/stylesheets/ 		135 KB
25 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://wicklow.demschooltools.com/assets/stylesheets/main.css
Requested by
Host: wicklow.demschooltools.com
URL: https://wicklow.demschooltools.com/login
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
143.42.5.249 Cedar Knolls, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS
143-42-5-249.ip.linodeusercontent.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
03af54b7361abcde4a6526869f4f35bcf280fff82768f56df6faa339ca5a9da4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wicklow.demschooltools.com/login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date
Thu, 01 Feb 2024 22:10:33 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
X-Permitted-Cross-Domain-Policies
master-only
Connection
keep-alive
Content-Length
24683
X-XSS-Protection
1; mode=block
Referrer-Policy
origin-when-cross-origin, strict-origin-when-cross-origin
Last-Modified
Fri, 01 Jan 2010 00:00:00 GMT
Server
nginx/1.18.0 (Ubuntu)
ETag
"58d1134d297e6eb913c5abb22fd485af"
Vary
Accept-Encoding
X-Frame-Options
DENY
Content-Type
text/css; charset=UTF-8
Cache-Control
public, max-age=3600
Accept-Ranges
bytes
google_signin.png
wicklow.demschooltools.com/assets/images/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://wicklow.demschooltools.com/assets/images/google_signin.png
Requested by
Host: wicklow.demschooltools.com
URL: https://wicklow.demschooltools.com/login
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
143.42.5.249 Cedar Knolls, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS
143-42-5-249.ip.linodeusercontent.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
c9124989ddb6a4c54ac930450171639ba9526c8f7ed9d2fdc548345fb3401d67
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wicklow.demschooltools.com/login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date
Thu, 01 Feb 2024 22:10:33 GMT
Referrer-Policy
origin-when-cross-origin, strict-origin-when-cross-origin
X-Content-Type-Options
nosniff
Last-Modified
Fri, 01 Jan 2010 00:00:00 GMT
Server
nginx/1.18.0 (Ubuntu)
X-Permitted-Cross-Domain-Policies
master-only
ETag
"58c5fe07d95e3e175cf596167694fc92"
X-Frame-Options
DENY
Content-Type
image/png
Cache-Control
public, max-age=3600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2316
X-XSS-Protection
1; mode=block
rollbar.min.js
cdn.rollbar.com/rollbarjs/refs/tags/v2.26.1/ 		78 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.rollbar.com/rollbarjs/refs/tags/v2.26.1/rollbar.min.js
Requested by
Host: wicklow.demschooltools.com
URL: https://wicklow.demschooltools.com/login
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.154.63.11 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-154-63-11.dus51.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
41764f6cf1cfa99fad12f1ee265ea0bb292761f6b15d1f5432756524854cd77f

Request headers

Referer
https://wicklow.demschooltools.com/
Origin
https://wicklow.demschooltools.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date
Thu, 01 Feb 2024 22:10:35 GMT
Content-Encoding
gzip
Via
1.1 6bc756891d4e5936d9d654c8c717a704.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
DUS51-P4
x-amz-server-side-encryption
AES256
Transfer-Encoding
chunked
X-Cache
Miss from cloudfront
Connection
keep-alive
Last-Modified
Wed, 04 Jan 2023 20:16:53 GMT
Server
AmazonS3
ETag
W/"ddf66d492e77fc149633a129f1f09c40"
Vary
Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=30672000,public
X-Amz-Cf-Id
xMUek6tovYXr1Ru7lBBFzPJLFkZej274MdcRx-GCdvdLnPU4uTLCJA==

Verdicts & Comments Add Verdict or Comment

29 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| _rollbarConfig object| _rollbarShims object| _rollbarWrappedError function| _rollbarURH object| Rollbar function| rollbar function| $ function| jQuery function| tinycolor function| enableTagBox function| enableNoPersonTagBox function| initAttendanceWeek function| initAttendancePerson function| initEditEntry function| initMinutesPage function| initRpList object| sorttable function| initCustodiaAdmin function| initPeopleChooser function| initChooser function| enableButtonForCheckboxes function| initCreateTransaction function| initTransactionList function| initSettingsPage function| initOffCampus function| initAttendanceRule number| _rollbarStartTime boolean| _rollbarDidLoad boolean| _rollbarInitialized

1 Cookies

Domain/Path Name / Value
wicklow.demschooltools.com/ Name: PLAY_SESSION
Value: eyJhbGciOiJIUzI1NiJ9.eyJkYXRhIjp7InBhLnVybC5vcmlnIjoiLyJ9LCJuYmYiOjE3MDY4MjU0MzMsImlhdCI6MTcwNjgyNTQzM30.4SR3tTJEoaPtvkavwp4qFELVlfxdjkiRkgsTSMi-6fk

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block