halifaxplc-verify.com
2606:4700:3036::6818:78d5  Malicious Activity!

Submitted URL: https://halifaxplc-verify.com/
Effective URL: https://halifaxplc-verify.com/login.php
Submission: On October 27 via automatic, source certstream-suspicious

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 2606:4700:3036::6818:78d5, located in United States and belongs to CLOUDFLARENET, US. The main domain is halifaxplc-verify.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on October 27th 2020. Valid for: a year.
This is the only time halifaxplc-verify.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Halifax Bank (Banking)

Domain & IP information

IP Address AS Autonomous System
1 9 2606:4700:303... 13335 (CLOUDFLAR...)
8 1
Domain
Subdomains
Transfer
9 halifaxplc-verify.com
.halifaxplc-verify.com
72 KB
8 1
Domain Requested by
9 halifaxplc-verify.com 1 redirects halifaxplc-verify.com
8 1

This site contains links to these domains. Also see Links.

Domain
www.halifax-online.co.uk
www.halifax.co.uk
Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2020-10-27 -
2021-10-26
a year crt.sh

This page contains 1 frames:

Primary Page: https://halifaxplc-verify.com/login.php
Frame ID: E7EBA1089D259A666946E8764A7278D8
Requests: 8 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://halifaxplc-verify.com/ HTTP 302
    https://halifaxplc-verify.com/login.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i

Page Statistics

8
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

72 kB
Transfer

152 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://halifaxplc-verify.com/ HTTP 302
    https://halifaxplc-verify.com/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request login.php
halifaxplc-verify.com/
Redirect Chain
  • https://halifaxplc-verify.com/
  • https://halifaxplc-verify.com/login.php
13 KB
3 KB
Document
General
Full URL
https://halifaxplc-verify.com/login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::6818:78d5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/7.3.23
Resource Hash
5cd300618c90fce51908839486d597e80aae016650957b50629605c976adf46d

Request headers

:method
GET
:authority
halifaxplc-verify.com
:scheme
https
:path
/login.php
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
__cfduid=d12ce841712ec8a3f3d58d8b1218903701603796084
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
date
Tue, 27 Oct 2020 10:54:44 GMT
content-type
text/html; charset=UTF-8
x-powered-by
PHP/7.3.23
vary
Accept-Encoding,User-Agent
cf-cache-status
DYNAMIC
cf-request-id
060b4b40b30000d725f98f9000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=gbelLkTPj1v4xlEld%2B99yz0XxnmYIheGuEtDdWEXPYQaQt9I8MMhdBz1OZ1tFPXEuCea6ar4aMeWaM57C3tvxyXJirC8%2Bbn%2F8okB68EvOBvSmLXFOq9T%2BcP53cCDPdbLL90%3D"}],"group":"cf-nel","max_age":604800}
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
5e8be17ab885d725-FRA
content-encoding
br

Redirect headers

status
302
date
Tue, 27 Oct 2020 10:54:44 GMT
content-type
text/html; charset=UTF-8
set-cookie
__cfduid=d12ce841712ec8a3f3d58d8b1218903701603796084; expires=Thu, 26-Nov-20 10:54:44 GMT; path=/; domain=.halifaxplc-verify.com; HttpOnly; SameSite=Lax; Secure
x-powered-by
PHP/7.3.23
location
login.php
vary
Accept-Encoding,User-Agent
cf-cache-status
DYNAMIC
cf-request-id
060b4b40870000d725ecb84000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=WP%2BXmc11suPkUAjUBHUFRffGZ7uJ4o7wb1x9Y56ztijYi86x6gwdgPu7kypqIpqpAxXQhg5WSKdk5Y23gBSQNqZxYBOTQaOpXJnun2yWtXkuMmMNHtXXcmdmUwvoSEE1JEc%3D"}],"group":"cf-nel","max_age":604800}
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
5e8be17a7fefd725-FRA
base-auto-min191016.css
halifaxplc-verify.com/hallifax_files/
87 KB
15 KB
Stylesheet
General
Full URL
https://halifaxplc-verify.com/hallifax_files/base-auto-min191016.css
Requested by
Host: halifaxplc-verify.com
URL: https://halifaxplc-verify.com/login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::6818:78d5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
edd93bfc0670f507b6031c443a29d30c1f3b69a7e4fb180e44f8e6bf8c59c7e1

Request headers

Referer
https://halifaxplc-verify.com/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 27 Oct 2020 10:54:46 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Sun, 08 Dec 2019 13:03:06 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding,User-Agent
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=79uvRErm%2BUuF8IjQr2AOfHUZ7dDFcei7AUyr8dQ8ZJWrwnSa1bZBm4oB4kvOmw4RRH3%2FdXEKarhVSDfWoDigMb6frL1%2BUuupJH1pZPfQIZgzgiunVyk7tO9wTpkujW%2FJD7c%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
status
200
cache-control
max-age=2592000
nel
{"report_to":"cf-nel","max_age":604800}
cf-ray
5e8be17b198ed725-FRA
cf-request-id
060b4b40f10000d725f98ff000000001
expires
Thu, 26 Nov 2020 10:54:46 GMT
main.css
halifaxplc-verify.com/form/
25 B
417 B
Stylesheet
General
Full URL
https://halifaxplc-verify.com/form/main.css
Requested by
Host: halifaxplc-verify.com
URL: https://halifaxplc-verify.com/login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::6818:78d5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3535dc4af7f2374897b37269eb1298da025b65d20f9054e10440d03c544c6575

Request headers

Referer
https://halifaxplc-verify.com/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 27 Oct 2020 10:54:45 GMT
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
status
200
content-length
25
cf-request-id
060b4b40f20000d7251038d000000001
last-modified
Sun, 08 Dec 2019 20:47:24 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding,User-Agent
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=cyTnDCEL9Vq4osFfAOF5V8E%2BN2YIMg1GYGomyTcUe0SLI%2F2S2z01NC16uZKB0cwerkxtHoU6etltEikeQmwLIZobvXJqwb9WyNo7WL88VOXgnfN%2FtE%2FQezWqwcGZgCrKkeg%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
5e8be17b1994d725-FRA
expires
Thu, 26 Nov 2020 10:54:45 GMT
Halifax-logo-1432115232.gif
halifaxplc-verify.com/hallifax_files/
6 KB
6 KB
Image
General
Full URL
https://halifaxplc-verify.com/hallifax_files/Halifax-logo-1432115232.gif
Requested by
Host: halifaxplc-verify.com
URL: https://halifaxplc-verify.com/login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::6818:78d5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
52f775c52a7a465d35c60169d86f01b09c6ac17d80b0ecb6c7301e17c0394fe4

Request headers

Referer
https://halifaxplc-verify.com/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 27 Oct 2020 10:54:46 GMT
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
status
200
content-length
6106
cf-request-id
060b4b40f50000d725c2181000000001
last-modified
Sun, 08 Dec 2019 13:03:10 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=5iESIVjYZuY3EzOle90gJF6i8yh%2FM2NVvWTfYDdL0C6Up%2B6iTjz4B9EiO7iajUC3HerUbrMY1ZHjaCxDVGenfMZdbOY%2BweHBUy7doPFFMn7tzyQqvi%2BFAlYfL67GmoFMUuY%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
max-age=31536000
accept-ranges
bytes
cf-ray
5e8be17b29a4d725-FRA
expires
Wed, 27 Oct 2021 10:54:46 GMT
padlock-secure-NGB-1432115235.gif
halifaxplc-verify.com/hallifax_files/
204 B
587 B
Image
General
Full URL
https://halifaxplc-verify.com/hallifax_files/padlock-secure-NGB-1432115235.gif
Requested by
Host: halifaxplc-verify.com
URL: https://halifaxplc-verify.com/login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::6818:78d5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a32d4cb0261b95eae669b741ad8938ad02057d0e0c1cc1638f9cd493a00274de

Request headers

Referer
https://halifaxplc-verify.com/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 27 Oct 2020 10:54:45 GMT
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
status
200
content-length
204
cf-request-id
060b4b40f50000d725ceb16000000001
last-modified
Sun, 08 Dec 2019 13:03:10 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=BqjVgYeJNm4FD%2Fa%2BoKH02VfnrG2Ij0Ls69GZre0tixxhE1GTgcMoS26%2BGIwN223Q%2Fph44d8SVRAkLhCK8VWwdz98ZPGsh9gHyIWUxYmINfkf5eHLYlN71%2FkYCWyv2aJ1UT8%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
max-age=31536000
accept-ranges
bytes
cf-ray
5e8be17b29a5d725-FRA
expires
Wed, 27 Oct 2021 10:54:45 GMT
personal-loan-ngb-login-banner-1569848374.jpg
halifaxplc-verify.com/hallifax_files/
12 KB
13 KB
Image
General
Full URL
https://halifaxplc-verify.com/hallifax_files/personal-loan-ngb-login-banner-1569848374.jpg
Requested by
Host: halifaxplc-verify.com
URL: https://halifaxplc-verify.com/login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::6818:78d5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1abee1b56b12d88ecf8514398d127f153da63acbb06c1b49a74c3c72ab70511b

Request headers

Referer
https://halifaxplc-verify.com/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 27 Oct 2020 10:54:45 GMT
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
status
200
content-length
12655
cf-request-id
060b4b40f50000d725088d9000000001
last-modified
Sun, 08 Dec 2019 13:03:10 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=cf5ZoiO%2BFeVVLt2C%2Fi5GrLWwOAA0AuXQrluNV07q5k2Qmc60%2FhsnybOLvFsCSfuryJkre4zA%2F6CQFCMPYmgh72lhQe0jaQbjFy3sgF4QROdEd4%2FfV5VErNIaUwGBjcinb%2Bw%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=31536000
accept-ranges
bytes
cf-ray
5e8be17b29a6d725-FRA
expires
Wed, 27 Oct 2021 10:54:45 GMT
fscs-ngb-logon-banner-V2-1459783745.png
halifaxplc-verify.com/hallifax_files/
33 KB
33 KB
Image
General
Full URL
https://halifaxplc-verify.com/hallifax_files/fscs-ngb-logon-banner-V2-1459783745.png
Requested by
Host: halifaxplc-verify.com
URL: https://halifaxplc-verify.com/login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::6818:78d5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ef18a59ce2fac55baba361d886d7835b66d2e8ecf485c3a4f59dd06fd819aa3f

Request headers

Referer
https://halifaxplc-verify.com/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 27 Oct 2020 10:54:46 GMT
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
status
200
content-length
33434
cf-request-id
060b4b40f60000d72533993000000001
last-modified
Sun, 08 Dec 2019 13:03:12 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=1LNaOYlPt5scrZfWEGG%2BNU0qNeQb76yAwFPpsfFnkAqEDj73UdtZx31799ZK4PA7%2BclnUTiGKIdb9FAlM8CXyknlgihuwvCeHm59zsGMnABpOphjk4CgQ2Fg4jaXapBIiNk%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=31536000
accept-ranges
bytes
cf-ray
5e8be17b29a8d725-FRA
expires
Wed, 27 Oct 2021 10:54:46 GMT
chevron_right_white.png
halifaxplc-verify.com/img/link_types/
315 B
315 B
Image
General
Full URL
https://halifaxplc-verify.com/img/link_types/chevron_right_white.png
Requested by
Host: halifaxplc-verify.com
URL: https://halifaxplc-verify.com/hallifax_files/base-auto-min191016.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::6818:78d5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

Referer
https://halifaxplc-verify.com/hallifax_files/base-auto-min191016.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 27 Oct 2020 10:54:46 GMT
content-encoding
br
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=CMxeka4OpXLYoJB%2B4cWMyeSfDvQHHxqSZrFpqMZzMbMG%2FoMyq1z3AtM3iddj3naA0ES%2Bo6PA2ZULsOgov1hnfuLYVqzyEVL2qXPMHW5kUo1B28uPWcjClFiWD1py0feNhF8%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=iso-8859-1
status
404
cache-control
max-age=14400
cf-ray
5e8be1840f2bd725-FRA
cf-request-id
060b4b46870000d725e3836000000001

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Halifax Bank (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes

1 Cookies

Domain/Path Name / Value
.halifaxplc-verify.com/ Name: __cfduid
Value: d12ce841712ec8a3f3d58d8b1218903701603796084