www.hq.patmolsecurity.co.ke Open in urlscan Pro
69.73.162.4 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.hq.patmolsecurity.co.ke/
Submission: On April 06 via automatic, source certstream-suspicious (April 6th 2020, 5:59:37 pm UTC)

Summary HTTP 16 Redirects Links 1 Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 16 HTTP transactions. The main IP is 69.73.162.4, located in Spring, United States and belongs to NTHL, US. The main domain is www.hq.patmolsecurity.co.ke.
TLS certificate: Issued by cPanel, Inc. Certification Authority on April 6th 2020. Valid for: 3 months.

This is the only time www.hq.patmolsecurity.co.ke was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
3	69.73.162.4 69.73.162.4		11042 (NTHL) (NTHL)
1	2a00:1450:400... 2a00:1450:4001:808::200a		15169 (GOOGLE) (GOOGLE)
16	3

3 69.73.162.4 (Spring, United States)

ASN11042 (NTHL, US)
PTR: tigh.nocdirect.com

www.hq.patmolsecurity.co.ke	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
hq.patmolsecurity.co.ke	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	patmolsecurity.co.ke www.hq.patmolsecurity.co.ke hq.patmolsecurity.co.ke	15 KB
1	googleapis.com fonts.googleapis.com	1 KB
16	2

	Domain	Requested by
2	hq.patmolsecurity.co.ke	www.hq.patmolsecurity.co.ke
1	fonts.googleapis.com	www.hq.patmolsecurity.co.ke
1	www.hq.patmolsecurity.co.ke
16	3

This site contains links to these domains. Also see Links.

Domain
hq.patmolsecurity.co.ke

Subject Issuer	Validity	Valid
hq.patmolsecurity.co.ke cPanel, Inc. Certification Authority	`2020-04-06` - `2020-07-05`	3 months	crt.sh
*.storage.googleapis.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.hq.patmolsecurity.co.ke/
Frame ID: A16FB1C7F0A7242F283BBE34CBB862F5
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i

animate.css (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link [^>]+(?:\/([\d.]+)\/)?animate\.(?:min\.)?css/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Ionicons (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+ionicons(?:\.min)?\.css/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

16
Requests

13 %
HTTPS

50 %
IPv6

2
Domains

3
Subdomains

3
IPs

2
Countries

16 kB
Transfer

33 kB
Size

2
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: http://hq.patmolsecurity.co.ke/admin/auth/forgot_password
Title: Forgot password?

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set / Show response
www.hq.patmolsecurity.co.ke/ 7 KB
7 KB 796ms
258ms Document
text/html 69.73.162.4
NTHL

General

Check archive.org

Show headers Download Go to

Full URL: https://www.hq.patmolsecurity.co.ke/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 69.73.162.4 Spring, United States, ASN11042 (NTHL, US),
Reverse DNS: tigh.nocdirect.com
Software: Apache /
Resource Hash: 759fb4af446d7f3fa2651e42a7017c01948471c270ea80c517c9e174f2926929

Request headers

Host: www.hq.patmolsecurity.co.ke
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document

Response headers

Date: Mon, 06 Apr 2020 17:59:18 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: csrf_hrsale=eae1243c791253ace95d34266bf9d7b4; expires=Mon, 06-Apr-2020 19:59:18 GMT; Max-Age=7200; path=/ ci_session=448ee2bedc99ded4cf02cc9eab32be168da58c19; expires=Mon, 06-Apr-2020 19:59:18 GMT; Max-Age=7200; path=/; HttpOnly
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H2 200 css
fonts.googleapis.com/ 19 KB
1 KB 18ms
18ms Stylesheet
text/css 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,600,700,300italic,400italic,600italic

Requested by

Host: www.hq.patmolsecurity.co.ke
URL: https://www.hq.patmolsecurity.co.ke/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e9f0630f0e4f98f2052dd35526703fbe408a32744e0ada0c814bd492fa8d68f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.hq.patmolsecurity.co.ke/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 06 Apr 2020 17:59:20 GMT
server: ESF
date: Mon, 06 Apr 2020 17:59:20 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 06 Apr 2020 17:59:20 GMT

GET
H/1.1 404
Not Found loading.gif
hq.patmolsecurity.co.ke/skin/img/ 0
0 506ms
383ms Image
text/html 69.73.162.4
NTHL

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://hq.patmolsecurity.co.ke/skin/img/loading.gif
Requested by: Host: www.hq.patmolsecurity.co.ke
URL: https://www.hq.patmolsecurity.co.ke/
Protocol: HTTP/1.1
Server: 69.73.162.4 Spring, United States, ASN11042 (NTHL, US),
Reverse DNS: tigh.nocdirect.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

GET
H/1.1 200
OK signin_logo_1559743677.png
hq.patmolsecurity.co.ke/uploads/logo/signin/ 8 KB
8 KB 371ms
248ms Image
image/png 69.73.162.4
NTHL

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://hq.patmolsecurity.co.ke/uploads/logo/signin/signin_logo_1559743677.png
Requested by: Host: www.hq.patmolsecurity.co.ke
URL: https://www.hq.patmolsecurity.co.ke/
Protocol: HTTP/1.1
Server: 69.73.162.4 Spring, United States, ASN11042 (NTHL, US),
Reverse DNS: tigh.nocdirect.com
Software: Apache /
Resource Hash: 19c6c4d6f3166ccafab8dbe9035a07023127edc7bd65fa10112f6eeaf8250008

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 06 Apr 2020 17:59:18 GMT
Last-Modified: Wed, 05 Jun 2019 14:07:56 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 7890

GET bootstrap.min.css
hq.patmolsecurity.co.ke/skin/hrsale_assets/theme_assets/bower_components/bootstrap/dist/css/ 0
0

GET font-awesome.min.css
hq.patmolsecurity.co.ke/skin/hrsale_assets/theme_assets/bower_components/font-awesome/css/ 0
0

GET ionicons.min.css
hq.patmolsecurity.co.ke/skin/hrsale_assets/theme_assets/bower_components/Ionicons/css/ 0
0

GET AdminLTE.min.css
hq.patmolsecurity.co.ke/skin/hrsale_assets/theme_assets/dist/css/ 0
0

GET toastr.min.css
hq.patmolsecurity.co.ke/skin/hrsale_assets/vendor/toastr/ 0
0

GET animate.css
hq.patmolsecurity.co.ke/skin/hrsale_assets/css/hrsale/ 0
0

GET xin_login_3.css
hq.patmolsecurity.co.ke/skin/hrsale_assets/css/hrsale/ 0
0

GET jquery.min.js
hq.patmolsecurity.co.ke/skin/hrsale_assets/theme_assets/bower_components/jquery/dist/ 0
0

GET bootstrap.min.js
hq.patmolsecurity.co.ke/skin/hrsale_assets/theme_assets/bower_components/bootstrap/dist/js/ 0
0

GET jquery-3.2.1.min.js
hq.patmolsecurity.co.ke/skin/hrsale_assets/vendor/jquery/ 0
0

GET toastr.min.js
hq.patmolsecurity.co.ke/skin/hrsale_assets/vendor/toastr/ 0
0

GET xin_login.js
hq.patmolsecurity.co.ke/skin/hrsale_assets/hrsale_scripts/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: hq.patmolsecurity.co.ke
URL: http://hq.patmolsecurity.co.ke/skin/hrsale_assets/theme_assets/bower_components/bootstrap/dist/css/bootstrap.min.css

Domain: hq.patmolsecurity.co.ke
URL: http://hq.patmolsecurity.co.ke/skin/hrsale_assets/theme_assets/bower_components/font-awesome/css/font-awesome.min.css

Domain: hq.patmolsecurity.co.ke
URL: http://hq.patmolsecurity.co.ke/skin/hrsale_assets/theme_assets/bower_components/Ionicons/css/ionicons.min.css

Domain: hq.patmolsecurity.co.ke
URL: http://hq.patmolsecurity.co.ke/skin/hrsale_assets/theme_assets/dist/css/AdminLTE.min.css

Domain: hq.patmolsecurity.co.ke
URL: http://hq.patmolsecurity.co.ke/skin/hrsale_assets/vendor/toastr/toastr.min.css

Domain: hq.patmolsecurity.co.ke
URL: http://hq.patmolsecurity.co.ke/skin/hrsale_assets/css/hrsale/animate.css

Domain: hq.patmolsecurity.co.ke
URL: http://hq.patmolsecurity.co.ke/skin/hrsale_assets/css/hrsale/xin_login_3.css

Domain: hq.patmolsecurity.co.ke
URL: http://hq.patmolsecurity.co.ke/skin/hrsale_assets/theme_assets/bower_components/jquery/dist/jquery.min.js

Domain: hq.patmolsecurity.co.ke
URL: http://hq.patmolsecurity.co.ke/skin/hrsale_assets/theme_assets/bower_components/bootstrap/dist/js/bootstrap.min.js

Domain: hq.patmolsecurity.co.ke
URL: http://hq.patmolsecurity.co.ke/skin/hrsale_assets/vendor/jquery/jquery-3.2.1.min.js

Domain: hq.patmolsecurity.co.ke
URL: http://hq.patmolsecurity.co.ke/skin/hrsale_assets/vendor/toastr/toastr.min.js

Domain: hq.patmolsecurity.co.ke
URL: http://hq.patmolsecurity.co.ke/skin/hrsale_assets/hrsale_scripts/xin_login.js

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate string| site_url string| processing_request

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.hq.patmolsecurity.co.ke/	1970-01-19 08:36:43	Name: ci_session Value: 448ee2bedc99ded4cf02cc9eab32be168da58c19
			www.hq.patmolsecurity.co.ke/	1970-01-19 08:36:43	Name: csrf_hrsale Value: eae1243c791253ace95d34266bf9d7b4

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
hq.patmolsecurity.co.ke
www.hq.patmolsecurity.co.ke
hq.patmolsecurity.co.ke
2a00:1450:4001:808::200a
69.73.162.4
19c6c4d6f3166ccafab8dbe9035a07023127edc7bd65fa10112f6eeaf8250008
759fb4af446d7f3fa2651e42a7017c01948471c270ea80c517c9e174f2926929
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e9f0630f0e4f98f2052dd35526703fbe408a32744e0ada0c814bd492fa8d68f6