URL: https://8r180.com/step2.php
Submission: On December 03 via automatic, source openphish

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 11 HTTP transactions. The main IP is 162.241.194.56, located in Provo, United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is 8r180.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on November 11th 2020. Valid for: 3 months.
This is the only time 8r180.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: UK Government (Government)

Domain & IP information

IP Address AS Autonomous System
10 162.241.194.56 46606 (UNIFIEDLA...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
11 3
Apex Domain
Subdomains
Transfer
10 8r180.com
8r180.com
272 KB
1 cloudflare.com
cdnjs.cloudflare.com
28 KB
11 2
Domain Requested by
10 8r180.com 8r180.com
1 cdnjs.cloudflare.com 8r180.com
11 2

This site contains no links.

Subject Issuer Validity Valid
autodiscover.8r180.com
Let's Encrypt Authority X3
2020-11-11 -
2021-02-09
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2020-10-21 -
2021-10-20
a year crt.sh

This page contains 1 frames:

Primary Page: https://8r180.com/step2.php
Frame ID: 554012C8841C80556F368A6A420F8E77
Requests: 13 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Overall confidence: 100%
Detected patterns
  • script /([\d.]+)?\/modernizr(?:.([\d.]+))?.*\.js/i

Overall confidence: 100%
Detected patterns
  • script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

11
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

464 kB
Transfer

742 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request step2.php
8r180.com/
9 KB
3 KB
Document
General
Full URL
https://8r180.com/step2.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.194.56 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-194-56.unifiedlayer.com
Software
nginx/1.19.0 /
Resource Hash
ea9027c9ae61414d5696f8da0bb156f37dba16f1a5d52c06bc2322db60084d2b

Request headers

:method
GET
:authority
8r180.com
:scheme
https
:path
/step2.php
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 03 Dec 2020 13:32:18 GMT
server
nginx/1.19.0
content-type
text/html; charset=UTF-8
content-length
3021
vary
Accept-Encoding
content-encoding
gzip
x-server-cache
false
govuk-template.css
8r180.com/assets/
21 KB
6 KB
Stylesheet
General
Full URL
https://8r180.com/assets/govuk-template.css
Requested by
Host: 8r180.com
URL: https://8r180.com/step2.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.194.56 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-194-56.unifiedlayer.com
Software
nginx/1.19.0 /
Resource Hash
cbe346eabd5db7c2af67efa1f0ffc686ca439990992e07ccf1c267c39ece59ed

Request headers

Referer
https://8r180.com/step2.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 03 Dec 2020 13:32:18 GMT
content-encoding
gzip
last-modified
Wed, 11 Nov 2020 14:05:58 GMT
server
nginx/1.19.0
x-server-cache
false
vary
Accept-Encoding
content-type
text/css
accept-ranges
none
content-length
5872
fonts.css
8r180.com/assets/
267 KB
196 KB
Stylesheet
General
Full URL
https://8r180.com/assets/fonts.css
Requested by
Host: 8r180.com
URL: https://8r180.com/step2.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.194.56 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-194-56.unifiedlayer.com
Software
nginx/1.19.0 /
Resource Hash
7f45917722737f19a1239a743cd5c161fce3a21c8bc328a648d74994750eec7d

Request headers

Referer
https://8r180.com/step2.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 03 Dec 2020 13:32:18 GMT
content-encoding
gzip
last-modified
Wed, 01 Jul 2020 18:44:56 GMT
server
nginx/1.19.0
x-server-cache
false
vary
Accept-Encoding
content-type
text/css
accept-ranges
bytes
application.min.css
8r180.com/assets/
178 KB
55 KB
Stylesheet
General
Full URL
https://8r180.com/assets/application.min.css
Requested by
Host: 8r180.com
URL: https://8r180.com/step2.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.194.56 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-194-56.unifiedlayer.com
Software
nginx/1.19.0 /
Resource Hash
9429d8e33aa731afdefa9fafbc886ffcc8f12b6c453b3c8af06097cd82ba8255

Request headers

Referer
https://8r180.com/step2.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 03 Dec 2020 13:32:18 GMT
content-encoding
gzip
last-modified
Wed, 11 Nov 2020 13:04:28 GMT
server
nginx/1.19.0
x-server-cache
false
vary
Accept-Encoding
content-type
text/css
accept-ranges
none
modernizr.js
8r180.com/assets/
9 KB
4 KB
Script
General
Full URL
https://8r180.com/assets/modernizr.js
Requested by
Host: 8r180.com
URL: https://8r180.com/step2.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.194.56 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-194-56.unifiedlayer.com
Software
nginx/1.19.0 /
Resource Hash
e23c69ceee504628dafaec629ef59259bf252c82d1486a155a5da0ac26e7365e

Request headers

Referer
https://8r180.com/step2.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 03 Dec 2020 13:32:18 GMT
content-encoding
gzip
last-modified
Wed, 01 Jul 2020 18:48:28 GMT
server
nginx/1.19.0
x-server-cache
false
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
none
content-length
4212
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/
87 KB
28 KB
Script
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js
Requested by
Host: 8r180.com
URL: https://8r180.com/step2.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
https://8r180.com/step2.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 03 Dec 2020 13:32:18 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
90371
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
content-length
27958
cf-request-id
06ca66ce310000325808b75000000001
timing-allow-origin
*
last-modified
Mon, 04 May 2020 23:01:39 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb09ed3-15d84"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Eo1Zp2G2%2BAHSWS%2FI24QwxCPJNxcFr3e%2BtiXRa%2Fs62WVWMNCHM9C5SMm7Iew4k2JIqWIG%2FkC4yHaLYrmKJ3SGpjnh7rWMqpvw814wNo7jVpefFeKquCbxn0bKKHLjIQY2VQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
5fbda729ed003258-FRA
expires
Tue, 23 Nov 2021 13:32:18 GMT
functions.js
8r180.com/includes/
540 B
405 B
Script
General
Full URL
https://8r180.com/includes/functions.js
Requested by
Host: 8r180.com
URL: https://8r180.com/step2.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.194.56 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-194-56.unifiedlayer.com
Software
nginx/1.19.0 /
Resource Hash
cf7fbba69961468018ac77381689859cef220acdd2b4a54bb290f0c193c399d9

Request headers

Referer
https://8r180.com/step2.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 03 Dec 2020 13:32:18 GMT
content-encoding
gzip
last-modified
Wed, 11 Nov 2020 13:37:10 GMT
server
nginx/1.19.0
x-server-cache
false
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
327
gov.uk_logotype_crown.png
8r180.com/assets/
780 B
865 B
Image
General
Full URL
https://8r180.com/assets/gov.uk_logotype_crown.png
Requested by
Host: 8r180.com
URL: https://8r180.com/step2.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.194.56 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-194-56.unifiedlayer.com
Software
nginx/1.19.0 /
Resource Hash
14b98db97bbd6cb1f33935d3e0d973fa68ca0c38fb5762b033423ceffe9e16f6

Request headers

Referer
https://8r180.com/step2.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 03 Dec 2020 13:32:19 GMT
content-length
780
last-modified
Wed, 11 Nov 2020 14:02:12 GMT
server
nginx/1.19.0
accept-ranges
bytes
x-server-cache
false
content-type
image/png
ogl.png
8r180.com/assets/
761 B
815 B
Image
General
Full URL
https://8r180.com/assets/ogl.png
Requested by
Host: 8r180.com
URL: https://8r180.com/step2.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.194.56 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-194-56.unifiedlayer.com
Software
nginx/1.19.0 /
Resource Hash
c1aedc8257961b938b4c7a21a2b0db3f2716dd9ef782cea73110dc69107c9042

Request headers

Referer
https://8r180.com/step2.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 03 Dec 2020 13:32:19 GMT
content-length
761
last-modified
Wed, 01 Jul 2020 18:41:42 GMT
server
nginx/1.19.0
accept-ranges
bytes
x-server-cache
false
content-type
image/png
truncated
/
94 KB
94 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
048b93884a1b51d20f2a3140541d450cb6b82c6c2cf69128ea1d09fdd9699f30

Request headers

Origin
https://8r180.com
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
application/font-woff
hmrc_crest_18px.png
8r180.com/assets/
2 KB
2 KB
Image
General
Full URL
https://8r180.com/assets/hmrc_crest_18px.png
Requested by
Host: 8r180.com
URL: https://8r180.com/assets/application.min.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.194.56 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-194-56.unifiedlayer.com
Software
nginx/1.19.0 /
Resource Hash
fd7aef78532fbfb2e32fa82c6d6276fd8fac9bc3cda21d9bf51ccc75bd935148

Request headers

Referer
https://8r180.com/assets/application.min.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 03 Dec 2020 13:32:19 GMT
content-length
1671
last-modified
Wed, 01 Jul 2020 19:54:26 GMT
server
nginx/1.19.0
accept-ranges
bytes
x-server-cache
false
content-type
image/png
truncated
/
71 KB
71 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
01c73d5dd84423dd2fc30aabd1de09a86b36b6de9e2e240d954c09cbb1d97aba

Request headers

Origin
https://8r180.com
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
application/font-woff
govuk-crest.png
8r180.com/assets/
4 KB
4 KB
Image
General
Full URL
https://8r180.com/assets/govuk-crest.png
Requested by
Host: 8r180.com
URL: https://8r180.com/assets/govuk-template.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.194.56 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-194-56.unifiedlayer.com
Software
nginx/1.19.0 /
Resource Hash
bb9e22aff7881b895c2ceb41d9340804451c474b883f09fe1b4026e76456f44b

Request headers

Referer
https://8r180.com/assets/govuk-template.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 03 Dec 2020 13:32:19 GMT
content-length
3584
last-modified
Wed, 01 Jul 2020 18:54:26 GMT
server
nginx/1.19.0
accept-ranges
bytes
x-server-cache
false
content-type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: UK Government (Government)

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| html5 object| Modernizr function| $ function| jQuery function| valid_credit_card object| card object| exp object| login

0 Cookies