www1.uimn.org Open in urlscan Pro
66.22.13.8 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://kantoria.com/templates/admin/jps/jp/final.html
Effective URL:
https://www1.uimn.org/ui_applicant/applicant/login.do
Submission: On January 25 via manual (January 25th 2022, 2:54:34 pm UTC) from US — Scanned from DE

Summary HTTP 22 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 3 domains to perform 22 HTTP transactions. The main IP is 66.22.13.8, located in and belongs to . The main domain is www1.uimn.org.
TLS certificate: Issued by Sectigo RSA Extended Validation Secur... on June 5th 2020. Valid for: 2 years.

This is the only time www1.uimn.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: US Government (Government)

Domain & IP information

	IP Address	AS Autonomous System
9	46.41.130.218 46.41.130.218	12824 (HOMEPL-AS) (HOMEPL-AS)
1	130.211.29.114 130.211.29.114	15169 (GOOGLE) (GOOGLE)
3	35.241.15.240 35.241.15.240	15169 (GOOGLE) (GOOGLE)
2	66.22.13.8 66.22.13.8	() ()
22	5

9 46.41.130.218 (Poland)

ASN12824 (HOMEPL-AS, PL)
PTR: vps-1030279-6947.homecloud.pl

kantoria.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 130.211.29.114 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 114.29.211.130.bc.googleusercontent.com

cdn.perfdrive.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.241.15.240 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 240.15.241.35.bc.googleusercontent.com

cas.avalon.perfdrive.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 66.22.13.8 (None, )

ASN- ()

www1.uimn.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	kantoria.com kantoria.com	370 KB
4	perfdrive.com cdn.perfdrive.com — Cisco Umbrella Rank: 18722 cas.avalon.perfdrive.com — Cisco Umbrella Rank: 10877	14 KB
2	uimn.org www1.uimn.org	9 KB
22	3

	Domain	Requested by
9	kantoria.com	kantoria.com
3	cas.avalon.perfdrive.com	cdn.perfdrive.com
2	www1.uimn.org	www1.uimn.org
1	cdn.perfdrive.com	kantoria.com
22	4

This site contains no links.

Subject Issuer	Validity	Valid
kantoria.com RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1	`2021-04-30` - `2022-05-02`	a year	crt.sh
*.perfdrive.com Go Daddy Secure Certificate Authority - G2	`2021-08-31` - `2022-09-26`	a year	crt.sh
cas.avalon.perfdrive.com Go Daddy Secure Certificate Authority - G2	`2021-08-04` - `2022-08-05`	a year	crt.sh
www1.uimn.org Sectigo RSA Extended Validation Secure Server CA	`2020-06-05` - `2022-06-05`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://www1.uimn.org/ui_applicant/applicant/login.do
Frame ID: 150AB6D47E9B08186618242DB2FE379E
Requests: 22 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://kantoria.com/templates/admin/jps/jp/final.html Page URL
https://www1.uimn.org/ui_applicant/applicant/login.do Page URL

Page Statistics

22
Requests

68 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

5
IPs

2
Countries

393 kB
Transfer

446 kB
Size

12
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://kantoria.com/templates/admin/jps/jp/final.html Page URL
https://www1.uimn.org/ui_applicant/applicant/login.do Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

22 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	final.html Show response kantoria.com/templates/admin/jps/jp/	11 KB 12 KB	133ms 32ms	Document text/html	46.41.130.218 HOMEPL-AS
General Check archive.org Show headers Download Go to Full URL https://kantoria.com/templates/admin/jps/jp/final.html Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 46.41.130.218 , Poland, ASN12824 (HOMEPL-AS, PL), Reverse DNS vps-1030279-6947.homecloud.pl Software Apache / PleskLin Resource Hash `90b7a4abdf8a3ec7fb12ea449990d0b70701f5bbb9510cfe33c7d20390585b95` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Date Tue, 25 Jan 2022 14:54:29 GMT Server Apache Last-Modified Mon, 10 Jan 2022 22:01:06 GMT ETag "b9206e0-2d9e-5d541792aec80" Accept-Ranges bytes Content-Length 11678 X-Powered-By PleskLin Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html
GET H/1.1	200 OK	aperture.js.download Show response kantoria.com/templates/admin/jps/jp/final_files/	44 KB 44 KB	32ms 32ms	Script application/javascript	46.41.130.218 HOMEPL-AS
General Check archive.org Show headers Download Go to Full URL https://kantoria.com/templates/admin/jps/jp/final_files/aperture.js.download Requested by Host: kantoria.com URL: https://kantoria.com/templates/admin/jps/jp/final.html Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 46.41.130.218 , Poland, ASN12824 (HOMEPL-AS, PL), Reverse DNS vps-1030279-6947.homecloud.pl Software Apache / PleskLin Resource Hash `1ef89c6057c63e1fd2bda3054817b95cb244d353dc1dafd2736e0ad49ca97924` Request headers Accept-Language de-DE,de;q=0.9 Referer https://kantoria.com/templates/admin/jps/jp/final.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Tue, 25 Jan 2022 14:54:29 GMT Last-Modified Mon, 10 Jan 2022 13:24:40 GMT Server Apache X-Powered-By PleskLin ETag "b9206e2-ae3a-5d53a42421600" Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 44602
GET H/1.1	200 OK	ruxitagentjs_ICA27Vdfhjqru_10229211201102017.js.download Show response kantoria.com/templates/admin/jps/jp/final_files/	216 KB 216 KB	95ms 32ms	Script application/javascript	46.41.130.218 HOMEPL-AS
General Check archive.org Show headers Download Go to Full URL https://kantoria.com/templates/admin/jps/jp/final_files/ruxitagentjs_ICA27Vdfhjqru_10229211201102017.js.download Requested by Host: kantoria.com URL: https://kantoria.com/templates/admin/jps/jp/final.html Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 46.41.130.218 , Poland, ASN12824 (HOMEPL-AS, PL), Reverse DNS vps-1030279-6947.homecloud.pl Software Apache / PleskLin Resource Hash `8d2e69c82db547dc318c04f2a13b8314a02212ffd807df68b9c40655dd995396` Request headers Accept-Language de-DE,de;q=0.9 Referer https://kantoria.com/templates/admin/jps/jp/final.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Tue, 25 Jan 2022 14:54:29 GMT Last-Modified Mon, 10 Jan 2022 13:24:40 GMT Server Apache X-Powered-By PleskLin ETag "b9206e5-35f13-5d53a42421600" Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 220947
GET H/1.1	200 OK	ui.css kantoria.com/templates/admin/jps/jp/final_files/	13 KB 13 KB	94ms 31ms	Stylesheet text/css	46.41.130.218 HOMEPL-AS
General Check archive.org Show headers Download Go to Full URL https://kantoria.com/templates/admin/jps/jp/final_files/ui.css Requested by Host: kantoria.com URL: https://kantoria.com/templates/admin/jps/jp/final.html Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 46.41.130.218 , Poland, ASN12824 (HOMEPL-AS, PL), Reverse DNS vps-1030279-6947.homecloud.pl Software Apache / PleskLin Resource Hash `819c5e6797cca1b144e323a7fbc9131b1896de02c153300bac606cfc8d1ed136` Request headers Accept-Language de-DE,de;q=0.9 Referer https://kantoria.com/templates/admin/jps/jp/final.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Tue, 25 Jan 2022 14:54:29 GMT Last-Modified Mon, 10 Jan 2022 13:24:40 GMT Server Apache X-Powered-By PleskLin ETag "b9206e7-327d-5d53a42421600" Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 12925
GET H/1.1	200 OK	util.js.download Show response kantoria.com/templates/admin/jps/jp/final_files/	6 KB 6 KB	96ms 32ms	Script application/javascript	46.41.130.218 HOMEPL-AS
General Check archive.org Show headers Download Go to Full URL https://kantoria.com/templates/admin/jps/jp/final_files/util.js.download Requested by Host: kantoria.com URL: https://kantoria.com/templates/admin/jps/jp/final.html Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 46.41.130.218 , Poland, ASN12824 (HOMEPL-AS, PL), Reverse DNS vps-1030279-6947.homecloud.pl Software Apache / PleskLin Resource Hash `93e8e837bd1f524a4379996066a315761ed610be5cedbca5cf4ef80696324a84` Request headers Accept-Language de-DE,de;q=0.9 Referer https://kantoria.com/templates/admin/jps/jp/final.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Tue, 25 Jan 2022 14:54:29 GMT Last-Modified Mon, 10 Jan 2022 13:24:40 GMT Server Apache X-Powered-By PleskLin ETag "b9206ee-1641-5d53a42421600" Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 5697
GET H/1.1	200 OK	spacer.gif kantoria.com/templates/admin/jps/jp/final_files/	43 B 341 B	32ms 32ms	Image image/gif	46.41.130.218 HOMEPL-AS
General Check archive.org Show headers Download Go to Show image Full URL https://kantoria.com/templates/admin/jps/jp/final_files/spacer.gif Requested by Host: kantoria.com URL: https://kantoria.com/templates/admin/jps/jp/final.html Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 46.41.130.218 , Poland, ASN12824 (HOMEPL-AS, PL), Reverse DNS vps-1030279-6947.homecloud.pl Software Apache / PleskLin Resource Hash `89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7` Request headers Accept-Language de-DE,de;q=0.9 Referer https://kantoria.com/templates/admin/jps/jp/final.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Tue, 25 Jan 2022 14:54:29 GMT Last-Modified Mon, 10 Jan 2022 13:24:40 GMT Server Apache X-Powered-By PleskLin ETag "b9206e6-2b-5d53a42421600" Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 43
GET H/1.1	200 OK	Unemployment%20Insurance%20Logo%20RGB-websites-projects.png kantoria.com/templates/admin/jps/jp/final_files/	77 KB 77 KB	33ms 33ms	Image image/png	46.41.130.218 HOMEPL-AS
General Check archive.org Show headers Download Go to Show image Full URL https://kantoria.com/templates/admin/jps/jp/final_files/Unemployment%20Insurance%20Logo%20RGB-websites-projects.png Requested by Host: kantoria.com URL: https://kantoria.com/templates/admin/jps/jp/final.html Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 46.41.130.218 , Poland, ASN12824 (HOMEPL-AS, PL), Reverse DNS vps-1030279-6947.homecloud.pl Software Apache / PleskLin Resource Hash `402df36267c7dd63cd0180cf618c6002668ff2f2268415fd4195925952d53268` Request headers Accept-Language de-DE,de;q=0.9 Referer https://kantoria.com/templates/admin/jps/jp/final.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Tue, 25 Jan 2022 14:54:29 GMT Last-Modified Mon, 10 Jan 2022 13:24:40 GMT Server Apache X-Powered-By PleskLin ETag "b9206eb-133e6-5d53a42421600" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 78822
GET H/1.1	200 OK	navLine.gif kantoria.com/templates/admin/jps/jp/final_files/	104 B 403 B	32ms 31ms	Image image/gif	46.41.130.218 HOMEPL-AS
General Check archive.org Show headers Download Go to Show image Full URL https://kantoria.com/templates/admin/jps/jp/final_files/navLine.gif Requested by Host: kantoria.com URL: https://kantoria.com/templates/admin/jps/jp/final.html Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 46.41.130.218 , Poland, ASN12824 (HOMEPL-AS, PL), Reverse DNS vps-1030279-6947.homecloud.pl Software Apache / PleskLin Resource Hash `a14c6bf0020e3a1e2b95f922e11a133071d8371e4e0f7410c4c739e4840b9132` Request headers Accept-Language de-DE,de;q=0.9 Referer https://kantoria.com/templates/admin/jps/jp/final.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Tue, 25 Jan 2022 14:54:29 GMT Last-Modified Mon, 10 Jan 2022 13:24:40 GMT Server Apache X-Powered-By PleskLin ETag "b9206e3-68-5d53a42421600" Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 104
GET H2	200	aperture.js Show response cdn.perfdrive.com/aperture/	44 KB 13 KB	56ms 17ms	Script application/javascript	130.211.29.114 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.perfdrive.com/aperture/aperture.js Requested by Host: kantoria.com URL: https://kantoria.com/templates/admin/jps/jp/final.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 130.211.29.114 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 114.29.211.130.bc.googleusercontent.com Software nginx/1.10.1 / Resource Hash `1ef89c6057c63e1fd2bda3054817b95cb244d353dc1dafd2736e0ad49ca97924` Request headers Accept-Language de-DE,de;q=0.9 Referer https://kantoria.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Tue, 25 Jan 2022 13:54:56 GMT content-encoding gzip last-modified Tue, 19 Oct 2021 12:48:01 GMT server nginx/1.10.1 age 3573 etag W/"616ebe81-ae3a" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=3600,public alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 13453 via 1.1 google
POST H2	200	jsdata Show response cas.avalon.perfdrive.com/	151 B 304 B	59ms 17ms	XHR text/plain	35.241.15.240 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cas.avalon.perfdrive.com/jsdata? Requested by Host: cdn.perfdrive.com URL: https://cdn.perfdrive.com/aperture/aperture.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.241.15.240 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 240.15.241.35.bc.googleusercontent.com Software / Resource Hash `e6220cf441d978eb45bf32fb3512b9168ef9a489bfe93ed1f463d8f2523f6dcd` Request headers Referer https://kantoria.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Content-type application/x-www-form-urlencoded Response headers access-control-allow-origin * x-response-time 0ms date Tue, 25 Jan 2022 14:54:30 GMT via 1.1 google alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 151 content-type text/plain; charset=UTF-8
POST H2	200	jsdata Show response cas.avalon.perfdrive.com/	151 B 210 B	58ms 18ms	XHR text/plain	35.241.15.240 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cas.avalon.perfdrive.com/jsdata? Requested by Host: cdn.perfdrive.com URL: https://cdn.perfdrive.com/aperture/aperture.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.241.15.240 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 240.15.241.35.bc.googleusercontent.com Software / Resource Hash `3e069b7086c4888f8edd0027de2a2a8eba97df89df620cfcacb57d7931620788` Request headers Referer https://kantoria.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Content-type application/x-www-form-urlencoded Response headers access-control-allow-origin * x-response-time 0ms date Tue, 25 Jan 2022 14:54:30 GMT via 1.1 google alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 151 content-type text/plain; charset=UTF-8
POST H2	200	jsdata Show response cas.avalon.perfdrive.com/	151 B 215 B	69ms 32ms	XHR text/plain	35.241.15.240 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cas.avalon.perfdrive.com/jsdata? Requested by Host: cdn.perfdrive.com URL: https://cdn.perfdrive.com/aperture/aperture.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.241.15.240 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 240.15.241.35.bc.googleusercontent.com Software / Resource Hash `077229bced7e6b250f3632ff96aef30cbe8e8f1d3080b543a30107c80c5fb6bd` Request headers Referer https://kantoria.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Content-type application/x-www-form-urlencoded Response headers access-control-allow-origin * x-response-time 14ms date Tue, 25 Jan 2022 14:54:30 GMT via 1.1 google alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 151 content-type text/plain; charset=UTF-8
POST H/1.1	404 Not Found	rb_bf91035bph kantoria.com/ui_javascripts/	1 KB 2 KB	33ms 32ms	Ping text/html	46.41.130.218 HOMEPL-AS
General Check archive.org Show headers Download Go to Full URL https://kantoria.com/ui_javascripts/rb_bf91035bph?type=js3&sn=v_4_srv_-2D45_sn_3KJL0ETBHE1NKIB2ENR0KRBOOPPIEE9L&svrid=-45&flavor=post&vi=LAPEWMFVRKHKFKTDHAIAFCIIKJWMNJUE-0&modifiedSince=1638787899265&rf=https%3A%2F%2Fkantoria.com%2Ftemplates%2Fadmin%2Fjps%2Fjp%2Ffinal.html&bp=3&app=06fe4f82790bea7d&crc=3980227863&en=sstvhqbf&end=1 Requested by Host: kantoria.com URL: https://kantoria.com/templates/admin/jps/jp/final_files/ruxitagentjs_ICA27Vdfhjqru_10229211201102017.js.download Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 46.41.130.218 , Poland, ASN12824 (HOMEPL-AS, PL), Reverse DNS vps-1030279-6947.homecloud.pl Software Apache / PleskLin Resource Hash Request headers Referer https://kantoria.com/templates/admin/jps/jp/final.html Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Date Tue, 25 Jan 2022 14:54:33 GMT Last-Modified Sat, 13 Nov 2021 11:21:13 GMT Server Apache X-Powered-By PleskLin ETag "a800447-5ba-5d0a9c6052796" Content-Type text/html Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 1466
GET H2	200	Primary Request login.do Show response www1.uimn.org/ui_applicant/applicant/	22 KB 6 KB	743ms 144ms	Document text/html	66.22.13.8
General Check archive.org Show headers Download Go to Full URL https://www1.uimn.org/ui_applicant/applicant/login.do Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 66.22.13.8 -, , ASN (), Reverse DNS Software / Resource Hash `b274e23dad80d8c710fd3d27cd3a40ed2c75ce8005d94d891e99157b49a7244e` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://kantoria.com/ Response headers content-type text/html; charset=ISO-8859-1 date Tue, 25 Jan 2022 14:54:33 GMT x-oneagent-js-injection true expires Thu, 01 Dec 1994 16:00:00 GMT cache-control no-cache="set-cookie, set-cookie2" server-timing dtSInfo;desc="0", dtRpid;desc="-1404306195" content-language en-US content-encoding gzip
GET		ruxitagentjs_ICA27Vdfhjqru_10231211201155045.js www1.uimn.org/ui_javascripts/	0 0

GET H2	200	ui.css www1.uimn.org/ui_applicant/stylesheets/	13 KB 3 KB	135ms 134ms	Stylesheet text/css	66.22.13.8
General Check archive.org Show headers Download Go to Full URL https://www1.uimn.org/ui_applicant/stylesheets/ui.css Requested by Host: www1.uimn.org URL: https://www1.uimn.org/ui_applicant/applicant/login.do Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 66.22.13.8 -, , ASN (), Reverse DNS Software / Resource Hash `819c5e6797cca1b144e323a7fbc9131b1896de02c153300bac606cfc8d1ed136` Request headers Accept-Language de-DE,de;q=0.9 Referer https://www1.uimn.org/ui_applicant/applicant/login.do User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Tue, 25 Jan 2022 14:54:33 GMT content-encoding gzip last-modified Thu, 13 Jan 2022 19:27:43 GMT server-timing dtSInfo;desc="0", dtRpid;desc="-2118092491" etag W/"327d-5d57bae27adf0" content-type text/css
GET		util.js www1.uimn.org/ui_applicant/javascripts/	0 0

GET		spacer.gif www1.uimn.org/ui_applicant/images/	0 0

GET		Unemployment%20Insurance%20Logo%20RGB-websites-projects.png www1.uimn.org/ui_applicant/images/	0 0

GET		UiApplicantDesign.js www1.uimn.org/ui_applicant/javascripts/	0 0

GET		b_start.gif www1.uimn.org/ui_applicant/images/	0 0

GET		b_login.gif www1.uimn.org/ui_applicant/images/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www1.uimn.org
URL: https://www1.uimn.org/ui_javascripts/ruxitagentjs_ICA27Vdfhjqru_10231211201155045.js

Domain: www1.uimn.org
URL: https://www1.uimn.org/ui_applicant/javascripts/util.js

Domain: www1.uimn.org
URL: https://www1.uimn.org/ui_applicant/images/spacer.gif

Domain: www1.uimn.org
URL: https://www1.uimn.org/ui_applicant/images/Unemployment%20Insurance%20Logo%20RGB-websites-projects.png

Domain: www1.uimn.org
URL: https://www1.uimn.org/ui_applicant/javascripts/UiApplicantDesign.js

Domain: www1.uimn.org
URL: https://www1.uimn.org/ui_applicant/images/b_start.gif

Domain: www1.uimn.org
URL: https://www1.uimn.org/ui_applicant/images/b_login.gif

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: US Government (Government)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

12 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.kantoria.com/	1970-01-20 04:44:34	Name: __ssds Value: 2
.kantoria.com/	1969-12-31 23:59:59	Name: dtCookie Value: v_4_srv_-2D45_sn_3KJL0ETBHE1NKIB2ENR0KRBOOPPIEE9L
.kantoria.com/	1969-12-31 23:59:59	Name: rxVisitor Value: 1643122469933LSEQM45K8P86KGPF31PFAJEKBTL6A8E6
.kantoria.com/	1969-12-31 23:59:59	Name: dtLatC Value: 51
.kantoria.com/	1969-12-31 23:59:59	Name: rxvt Value: 1643124270027\|1643122469934
.kantoria.com/	1969-12-31 23:59:59	Name: dtPC Value: -45$322469930_751h2vLAPEWMFVRKHKFKTDHAIAFCIIKJWMNJUE-0e0
.kantoria.com/	1970-01-20 04:44:34	Name: __ssuzjsr2 Value: a9be2cd8e
.kantoria.com/	1970-01-20 04:44:34	Name: __uzmaj2 Value: 2b24457f-38b1-4d8b-86fa-393193265e4f
.kantoria.com/	1970-01-20 04:44:34	Name: __uzmbj2 Value: 1643122470
.kantoria.com/	1970-01-20 04:44:34	Name: __uzmcj2 Value: 470741068334
.kantoria.com/	1970-01-20 04:44:34	Name: __uzmdj2 Value: 1643122470
.kantoria.com/	1969-12-31 23:59:59	Name: dtSa Value: false%7C_load_%7C2%7C_onload_%7C-%7C1643122470026%7C322469930_751%7Chttps%3A%2F%2Fkantoria.com%2Ftemplates%2Fadmin%2Fjps%2Fjp%2Ffinal.html%7C%7C%7C%7C

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://kantoria.com/ui_javascripts/rb_bf91035bph?type=js3&sn=v_4_srv_-2D45_sn_3KJL0ETBHE1NKIB2ENR0KRBOOPPIEE9L&svrid=-45&flavor=post&vi=LAPEWMFVRKHKFKTDHAIAFCIIKJWMNJUE-0&modifiedSince=1638787899265&rf=https%3A%2F%2Fkantoria.com%2Ftemplates%2Fadmin%2Fjps%2Fjp%2Ffinal.html&bp=3&app=06fe4f82790bea7d&crc=3980227863&en=sstvhqbf&end=1 Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cas.avalon.perfdrive.com
cdn.perfdrive.com
kantoria.com
www1.uimn.org
www1.uimn.org
130.211.29.114
35.241.15.240
46.41.130.218
66.22.13.8
077229bced7e6b250f3632ff96aef30cbe8e8f1d3080b543a30107c80c5fb6bd
1ef89c6057c63e1fd2bda3054817b95cb244d353dc1dafd2736e0ad49ca97924
3e069b7086c4888f8edd0027de2a2a8eba97df89df620cfcacb57d7931620788
402df36267c7dd63cd0180cf618c6002668ff2f2268415fd4195925952d53268
819c5e6797cca1b144e323a7fbc9131b1896de02c153300bac606cfc8d1ed136
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8d2e69c82db547dc318c04f2a13b8314a02212ffd807df68b9c40655dd995396
90b7a4abdf8a3ec7fb12ea449990d0b70701f5bbb9510cfe33c7d20390585b95
93e8e837bd1f524a4379996066a315761ed610be5cedbca5cf4ef80696324a84
a14c6bf0020e3a1e2b95f922e11a133071d8371e4e0f7410c4c739e4840b9132
b274e23dad80d8c710fd3d27cd3a40ed2c75ce8005d94d891e99157b49a7244e
e6220cf441d978eb45bf32fb3512b9168ef9a489bfe93ed1f463d8f2523f6dcd

www1.uimn.org Open in urlscan Pro 66.22.13.8 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

22 Requests

68 %HTTPS

0 %IPv6

3 Domains

4 Subdomains

5 IPs

2 Countries

393 kBTransfer

446 kBSize

12 Cookies

0 Outgoing links

Page URL History

Redirected requests

22 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

12 Cookies

1 Console Messages

Indicators

www1.uimn.org Open in urlscan Pro
66.22.13.8 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

22
Requests

68 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

5
IPs

2
Countries

393 kB
Transfer

446 kB
Size

12
Cookies

22 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!