nhs-pcrtestkit-orders.com
Open in
urlscan Pro
34.163.74.206
Malicious Activity!
Public Scan
Effective URL: http://nhs-pcrtestkit-orders.com/main/
Submission: On October 10 via api from GB — Scanned from FR
Summary
This is the only time nhs-pcrtestkit-orders.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: NHS UK (Healthcare)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
8 | 34.163.74.206 34.163.74.206 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
2 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:3a | 20446 (STACKPATH...) (STACKPATH-CDN) | |
2 | 96.16.146.114 96.16.146.114 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
12 | 4 |
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 206.74.163.34.bc.googleusercontent.com
nhs-pcrtestkit-orders.com |
ASN16625 (AKAMAI-AS, US)
PTR: a96-16-146-114.deploy.static.akamaitechnologies.com
assets.nhs.uk |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
nhs-pcrtestkit-orders.com
nhs-pcrtestkit-orders.com |
143 KB |
2 |
assets.nhs.uk
assets.nhs.uk — Cisco Umbrella Rank: 53167 |
35 KB |
2 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 977 |
112 KB |
12 | 3 |
Domain | Requested by | |
---|---|---|
8 | nhs-pcrtestkit-orders.com |
nhs-pcrtestkit-orders.com
code.jquery.com |
2 | assets.nhs.uk |
nhs-pcrtestkit-orders.com
|
2 | code.jquery.com |
nhs-pcrtestkit-orders.com
|
12 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2022-08-03 - 2023-07-14 |
a year | crt.sh |
www.nhs.uk DigiCert TLS RSA SHA256 2020 CA1 |
2022-08-02 - 2023-08-02 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://nhs-pcrtestkit-orders.com/main/
Frame ID: 3FD47F78CCC8E4C8EE7419A337C07B68
Requests: 13 HTTP requests in this frame
Screenshot
Page Title
Book or manage a coronavirus (COVID-19) testkit - NHSPage URL History Show full URLs
- http://nhs-pcrtestkit-orders.com/ Page URL
- http://nhs-pcrtestkit-orders.com/cloud.php?n=8278 Page URL
- http://nhs-pcrtestkit-orders.com/main/ Page URL
Detected technologies
jQuery (JavaScript Libraries) ExpandDetected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://nhs-pcrtestkit-orders.com/ Page URL
- http://nhs-pcrtestkit-orders.com/cloud.php?n=8278 Page URL
- http://nhs-pcrtestkit-orders.com/main/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
nhs-pcrtestkit-orders.com/ |
358 KB 43 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.js
code.jquery.com/ |
276 KB 82 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
m3d.compiled.js
nhs-pcrtestkit-orders.com/m3dularbh/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
cloud.php
nhs-pcrtestkit-orders.com/ |
348 KB 42 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-2.2.4.min.js
code.jquery.com/ |
84 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ajax.php
nhs-pcrtestkit-orders.com/m3dularbh/ |
0 130 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
Primary Request
/
nhs-pcrtestkit-orders.com/main/ |
17 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
FrutigerLTW01-55Roman.woff2
nhs-pcrtestkit-orders.com/main/fonts/ |
17 KB 17 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
FrutigerLTW01-65Bold.woff2
nhs-pcrtestkit-orders.com/main/fonts/ |
17 KB 17 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.0a8983858941.css
nhs-pcrtestkit-orders.com/main/static/nhsuk/css/ |
131 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
FrutigerLTW01-55Roman.woff2
assets.nhs.uk/fonts/ |
17 KB 17 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
296 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
FrutigerLTW01-65Bold.eot
assets.nhs.uk/fonts/ |
17 KB 17 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: NHS UK (Healthcare)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch object| navigation0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
assets.nhs.uk
code.jquery.com
nhs-pcrtestkit-orders.com
2001:4de0:ac18::1:a:3a
34.163.74.206
96.16.146.114
035e6621c40c782cd443742228ef6c1dd0667c13951c4ce5400c510eb48076c9
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
22486769e9d3c504b5c9727062e4ed2cc719177a6a5ec54aa9aca5a0089c6faa
3029834a820c79c154c377f52e2719fc3ff2a27600a07ae089ea7fde9087f6bc
31f475f99c5faf3f24bc7ba0314bf0ab5fccc9313bb22d3d405d16b4b84dbfc5
453c06b657dfde66cb3a88a952795b75884a028f7397d20c2d4c071bc58c719c
473e82fed60b3c3d3a528ccd66946f6fe3de6d58ce358f4a3aee7a17ccc080e3
886f640d4cb31c0114351f25e5eeba98b79e7ae405fcc2ca50aac6ed79ff8995
b42e4b001a9a32b1b9626740d88541d7a4742db0057a20a160cfe5dd6623fc53
d7a61b8131c25f4f7949162fcf342c8ba52b0257756aaacf23aa948f0403c842
f3d208433e88c1fd7d17efa9dcd0bff7d8f2801afd9a08a5d33cfa0314ff42bd