![](/screenshots/528e2697-9f69-408c-a871-d5dda1fb04c6.png)
operator-reports.prod.edh.dvsacloud.uk
Open in
urlscan Pro
2600:9000:20c3:e200:3:3b59:8340:93a1
Malicious Activity!
Public Scan
Effective URL: https://operator-reports.prod.edh.dvsacloud.uk/signout.html
Submission: On February 27 via manual from GB — Scanned from GB
Summary
TLS certificate: Issued by Amazon RSA 2048 M03 on February 21st 2024. Valid for: a year.
This is the only time operator-reports.prod.edh.dvsacloud.uk was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: UK Government (Government)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2600:9000:20c... 2600:9000:20c3:ba00:3:3b59:8340:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
19 | 2600:9000:20c... 2600:9000:20c3:e200:3:3b59:8340:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 45.60.74.18 45.60.74.18 | 19551 (INCAPSULA) (INCAPSULA) | |
23 | 3 |
ASN16509 (AMAZON-02, US)
operator-reports.prod.edh.dvsacloud.uk |
ASN16509 (AMAZON-02, US)
operator-reports.prod.edh.dvsacloud.uk |
Apex Domain Subdomains |
Transfer | |
---|---|---|
20 |
dvsacloud.uk
1 redirects
operator-reports.prod.edh.dvsacloud.uk |
1 MB |
1 |
dvsa.gov.uk
operator-reports-api.dvsa.gov.uk Failed |
|
23 | 2 |
Domain | Requested by | |
---|---|---|
20 | operator-reports.prod.edh.dvsacloud.uk |
1 redirects
operator-reports.prod.edh.dvsacloud.uk
|
1 | operator-reports-api.dvsa.gov.uk |
operator-reports.prod.edh.dvsacloud.uk
|
23 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.gov.uk |
www.nationalarchives.gov.uk |
Subject Issuer | Validity | Valid | |
---|---|---|---|
operator-reports.prod.edh.dvsacloud.uk Amazon RSA 2048 M03 |
2024-02-21 - 2025-03-22 |
a year | crt.sh |
imperva.com GlobalSign Atlas R3 DV TLS CA 2023 Q3 |
2023-09-19 - 2024-03-17 |
6 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://operator-reports.prod.edh.dvsacloud.uk/signout.html
Frame ID: B91B6EE8F49021EDBBE2BE543ED2A468
Requests: 21 HTTP requests in this frame
Screenshot
![](/screenshots/528e2697-9f69-408c-a871-d5dda1fb04c6.png)
Page Title
Operator Reports Service - Vehicle Encounter ReportPage URL History Show full URLs
-
http://operator-reports.prod.edh.dvsacloud.uk/
HTTP 301
https://operator-reports.prod.edh.dvsacloud.uk/ Page URL
- https://operator-reports.prod.edh.dvsacloud.uk/signout.html Page URL
Detected technologies
![](/vendor/wappa/icons/govuk.png)
Detected patterns
- <body[^>]+govuk-template__body
- <a[^>]+govuk-link
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
3 Outgoing links
These are links going to different origins than the main page.
Title: Transport and driving businesses
Search URL Search Domain Scan URL
Title: Open Government Licence v3.0
Search URL Search Domain Scan URL
Title: © Crown copyright
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://operator-reports.prod.edh.dvsacloud.uk/
HTTP 301
https://operator-reports.prod.edh.dvsacloud.uk/ Page URL
- https://operator-reports.prod.edh.dvsacloud.uk/signout.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://operator-reports.prod.edh.dvsacloud.uk/ HTTP 301
- https://operator-reports.prod.edh.dvsacloud.uk/
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
operator-reports.prod.edh.dvsacloud.uk/ Redirect Chain
|
13 KB 13 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
application.css
operator-reports.prod.edh.dvsacloud.uk/ |
172 KB 173 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-1.11.3.js
operator-reports.prod.edh.dvsacloud.uk/public/javascripts/ |
278 KB 279 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
config.js
operator-reports.prod.edh.dvsacloud.uk/public/javascripts/ |
274 B 693 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
worker.js
operator-reports.prod.edh.dvsacloud.uk/public/javascripts/ |
4 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
govuk.js
operator-reports.prod.edh.dvsacloud.uk/public/javascripts/ |
100 KB 100 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
application.js
operator-reports.prod.edh.dvsacloud.uk/public/javascripts/ |
84 B 502 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
govuk-crest.png
operator-reports.prod.edh.dvsacloud.uk/assets/images/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bold-b542beb274-v2.woff2
operator-reports.prod.edh.dvsacloud.uk/assets/fonts/ |
31 KB 31 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
light-94a07e06a1-v2.woff2
operator-reports.prod.edh.dvsacloud.uk/assets/fonts/ |
33 KB 33 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Primary Request
signout.html
operator-reports.prod.edh.dvsacloud.uk/ |
10 KB 10 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS |
status
operator-reports-api.dvsa.gov.uk/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
status
operator-reports-api.dvsa.gov.uk/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
application.css
operator-reports.prod.edh.dvsacloud.uk/ |
172 KB 172 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery-1.11.3.js
operator-reports.prod.edh.dvsacloud.uk/public/javascripts/ |
278 KB 278 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
govuk.js
operator-reports.prod.edh.dvsacloud.uk/public/javascripts/ |
100 KB 100 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
config.js
operator-reports.prod.edh.dvsacloud.uk/public/javascripts/ |
274 B 715 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
application.js
operator-reports.prod.edh.dvsacloud.uk/public/javascripts/ |
84 B 530 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
govuk-crest.png
operator-reports.prod.edh.dvsacloud.uk/assets/images/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bold-b542beb274-v2.woff2
operator-reports.prod.edh.dvsacloud.uk/assets/fonts/ |
31 KB 31 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
light-94a07e06a1-v2.woff2
operator-reports.prod.edh.dvsacloud.uk/assets/fonts/ |
33 KB 33 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
DELETE |
session
operator-reports-api.dvsa.gov.uk/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
session
operator-reports-api.dvsa.gov.uk/ |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- operator-reports-api.dvsa.gov.uk
- URL
- https://operator-reports-api.dvsa.gov.uk/status?path=/
- Domain
- operator-reports-api.dvsa.gov.uk
- URL
- https://operator-reports-api.dvsa.gov.uk/status?path=/
- Domain
- operator-reports-api.dvsa.gov.uk
- URL
- https://operator-reports-api.dvsa.gov.uk/session
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: UK Government (Government)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery object| GOVUKFrontend object| gProperties0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
operator-reports-api.dvsa.gov.uk
operator-reports.prod.edh.dvsacloud.uk
operator-reports-api.dvsa.gov.uk
2600:9000:20c3:ba00:3:3b59:8340:93a1
2600:9000:20c3:e200:3:3b59:8340:93a1
45.60.74.18
050c1643049a760c3e18811d2a3ea6c96af4484d96eecb6daf132ff144270ab8
06eba01b1af0f4014b484c711771fef1db30becbf0edf481498da1e4958d3d47
3b6f944997a9fdd21ac4254b95a963dd0182eececb1750e78a859a4de1ee0886
564effbd2cfb390180465aef5ba2721f76f58f85baa73e18e942ccb98bd30119
5de3a7989ebe3aa8e059f89efbc9b98d60baa608e484c82cb4603cd3523f2e85
7af040b1e53638711e40257be505e612aeb5496bb6d5016ac28df499dc6d2a7a
b0430ab7e412f8cc22300fe9c8af018aa25a74d39f404281a0e6f1093b6a4ebf
bb9e22aff7881b895c2ceb41d9340804451c474b883f09fe1b4026e76456f44b
dc80ed2606fa83e81529cc761f0b34708433a5bc9c31b0b1934bfac4e727327c
eedfb3c2f7945caebd0b15522b59d6c7f01be17fecd6102fd76452ad4042f7b0
fc6af31321a3004a940da9c8fee60aceba42607a5db897729f682b6433c90e60