18.169.97.107
Open in
urlscan Pro
18.169.97.107
Malicious Activity!
Public Scan
Submission: On June 15 via automatic, source openphish
Summary
TLS certificate: Issued by Amazon on July 14th 2020. Valid for: a year.
This is the only time 18.169.97.107 was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: UK Government (Government)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
6 | 18.169.97.107 18.169.97.107 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2600:9000:206... 2600:9000:206e:d800:e:3706:bd00:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2a00:1450:400... 2a00:1450:4001:82f::2008 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2001:470:6e0a... 2001:470:6e0a::1b:243 | 6939 (HURRICANE) (HURRICANE) | |
9 | 4 |
ASN16509 (AMAZON-02, US)
PTR: ec2-18-169-97-107.eu-west-2.compute.amazonaws.com
18.169.97.107 |
ASN16509 (AMAZON-02, US)
cc.cdn.civiccomputing.com |
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
civiccomputing.com
cc.cdn.civiccomputing.com apikeys.civiccomputing.com |
69 KB |
1 |
googletagmanager.com
www.googletagmanager.com |
30 KB |
9 | 2 |
Domain | Requested by | |
---|---|---|
1 | apikeys.civiccomputing.com |
cc.cdn.civiccomputing.com
|
1 | www.googletagmanager.com |
18.169.97.107
|
1 | cc.cdn.civiccomputing.com |
18.169.97.107
|
9 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.gov.uk |
www.nationalarchives.gov.uk |
Subject Issuer | Validity | Valid | |
---|---|---|---|
preprod-support.cleanairzonevehiclecheck.co.uk Amazon |
2020-07-14 - 2021-08-14 |
a year | crt.sh |
*.cdn.civiccomputing.com Amazon |
2020-11-21 - 2021-12-20 |
a year | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2021-05-17 - 2021-08-09 |
3 months | crt.sh |
apikeys.civiccomputing.com R3 |
2021-04-29 - 2021-07-28 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://18.169.97.107/
Frame ID: 428EAE6ABC12A073403CA632E266748A
Requests: 9 HTTP requests in this frame
Screenshot
Detected technologies
Ruby (Programming Languages) ExpandDetected patterns
- meta csrf-param /^authenticity_token$/i
Ruby on Rails (Web Frameworks) Expand
Detected patterns
- meta csrf-param /^authenticity_token$/i
Google Tag Manager (Tag Managers) Expand
Detected patterns
- html /googletagmanager\.com\/ns\.html[^>]+><\/iframe>/i
- html /<!-- (?:End )?Google Tag Manager -->/i
Page Statistics
3 Outgoing links
These are links going to different origins than the main page.
Title: GOV.UK
Search URL Search Domain Scan URL
Title: Open Government Licence v3.0,
Search URL Search Domain Scan URL
Title: © Crown copyright
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
18.169.97.107/ |
13 KB 13 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
application-749c25d9.css
18.169.97.107/packs/css/ |
148 KB 15 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cookieControl-9.1.min.js
cc.cdn.civiccomputing.com/9/ |
245 KB 68 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
application-34884926ec09fc4a80c7.js
18.169.97.107/packs/js/ |
51 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gtm.js
www.googletagmanager.com/ |
75 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
govuk-crest.png
18.169.97.107/packs/media/images/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bold-b542beb274-v2.woff2
18.169.97.107/packs/media/fonts/ |
31 KB 31 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
light-94a07e06a1-v2.woff2
18.169.97.107/packs/media/fonts/ |
33 KB 33 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
v
apikeys.civiccomputing.com/c/ |
107 B 545 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: UK Government (Government)28 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| dataLayer function| setImmediate function| clearImmediate object| regeneratorRuntime object| CookieControl string| gaID string| apiKey string| product string| serviceName string| cookiesPath string| introText string| necessaryDescription string| cookiesDescription function| hideAcceptButton object| config boolean| _rails_loaded object| google_tag_manager1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
18.169.97.107/ | Name: _customer_service_session Value: 7eae54a321861efc2b552a65bba9e1fd |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | default-src 'none'; font-src 'self' https: data:; img-src 'self' https:; object-src 'none'; script-src 'self' https: 'unsafe-inline'; style-src 'self' https: 'unsafe-inline'; connect-src 'self' https:; frame-src https://www.googletagmanager.com; frame-ancestors 'none' |
Strict-Transport-Security | max-age=31536000 |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
apikeys.civiccomputing.com
cc.cdn.civiccomputing.com
www.googletagmanager.com
18.169.97.107
2001:470:6e0a::1b:243
2600:9000:206e:d800:e:3706:bd00:93a1
2a00:1450:4001:82f::2008
06eba01b1af0f4014b484c711771fef1db30becbf0edf481498da1e4958d3d47
29032558fb2cf9d777899b328fb94d9078c70e8b88b7c96dea5738426eb49d8c
2c6244860a7c6eec97e0fefd269089acefe0615c893bbe6c88ad80ca7415f28b
302a2ba50620fc6d23a8395124daa850e451cfad9a148e2a4ba1819031d08c75
b95ddc1e9b291859225c11f4f473293e86937c998d656fb351680f8dbe9c0274
bb9e22aff7881b895c2ceb41d9340804451c474b883f09fe1b4026e76456f44b
e2592e0d8a29fc5964a5e61d085a881804de08881f36fe489fd2f43db67abd07
e441dc10b873623dc6915d94b2ad48acee5b70fd546f4937065a64fb06159ac3
eedfb3c2f7945caebd0b15522b59d6c7f01be17fecd6102fd76452ad4042f7b0