safedriving-school.co.uk
Open in
urlscan Pro
176.74.27.65
Malicious Activity!
Public Scan
Effective URL: http://safedriving-school.co.uk/css/form/YASSCOMV3_2019/d032f72ab557e2386d87bb137b4bdbbf/secureaccount.php?country.x=DE&locale.x...
Submission: On October 26 via manual from US
Summary
This is the only time safedriving-school.co.uk was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PayPal (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 91.227.138.36 91.227.138.36 | 20845 (DIGICABLE) (DIGICABLE) | |
3 8 | 176.74.27.65 176.74.27.65 | 38719 (DREAMSCAP...) (DREAMSCAPE-AS-AP Dreamscape Networks Limited) | |
5 | 23.210.248.226 23.210.248.226 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
11 | 3 |
ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU)
PTR: wc2-shared.uk.syrahost.com
safedriving-school.co.uk |
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a23-210-248-226.deploy.static.akamaitechnologies.com
www.paypalobjects.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
safedriving-school.co.uk
3 redirects
safedriving-school.co.uk |
48 KB |
5 |
paypalobjects.com
www.paypalobjects.com |
148 KB |
1 |
levendulatunder.hu
levendulatunder.hu |
504 B |
11 | 3 |
Domain | Requested by | |
---|---|---|
8 | safedriving-school.co.uk |
3 redirects
safedriving-school.co.uk
|
5 | www.paypalobjects.com |
safedriving-school.co.uk
|
1 | levendulatunder.hu | |
11 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.paypal.com DigiCert SHA2 Extended Validation Server CA |
2019-09-10 - 2020-08-18 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://safedriving-school.co.uk/css/form/YASSCOMV3_2019/d032f72ab557e2386d87bb137b4bdbbf/secureaccount.php?country.x=DE&locale.x=de_DE&customer.x=ID-PA$1$hN0qLr7c$vRBjhvoLRxYDJ/kvifyhG0&safety=9Fe8aa8feHad07Yp4qfbvNwb97r4G8B4Qyif133WzDot2MAP2eZfX66O0uUgc2741lhTnEeeS5618JV170CxkLeKsmjIR6
Frame ID: 85D54915FD006351C1807CBF7ACFE9F3
Requests: 11 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- http://levendulatunder.hu/ffc/ Page URL
-
http://safedriving-school.co.uk/css/form/YASSCOMV3_2019/
HTTP 302
http://safedriving-school.co.uk/css/form/YASSCOMV3_2019/XYSDIRX.php HTTP 302
http://safedriving-school.co.uk/css/form/YASSCOMV3_2019/d032f72ab557e2386d87bb137b4bdbbf HTTP 301
http://safedriving-school.co.uk/css/form/YASSCOMV3_2019/d032f72ab557e2386d87bb137b4bdbbf/ Page URL
- http://safedriving-school.co.uk/css/form/YASSCOMV3_2019/d032f72ab557e2386d87bb137b4bdbbf/secureaccount.php?c... Page URL
Detected technologies
Debian (Operating Systems) ExpandDetected patterns
- headers server /Debian/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://levendulatunder.hu/ffc/ Page URL
-
http://safedriving-school.co.uk/css/form/YASSCOMV3_2019/
HTTP 302
http://safedriving-school.co.uk/css/form/YASSCOMV3_2019/XYSDIRX.php HTTP 302
http://safedriving-school.co.uk/css/form/YASSCOMV3_2019/d032f72ab557e2386d87bb137b4bdbbf HTTP 301
http://safedriving-school.co.uk/css/form/YASSCOMV3_2019/d032f72ab557e2386d87bb137b4bdbbf/ Page URL
- http://safedriving-school.co.uk/css/form/YASSCOMV3_2019/d032f72ab557e2386d87bb137b4bdbbf/secureaccount.php?country.x=DE&locale.x=de_DE&customer.x=ID-PA$1$hN0qLr7c$vRBjhvoLRxYDJ/kvifyhG0&safety=9Fe8aa8feHad07Yp4qfbvNwb97r4G8B4Qyif133WzDot2MAP2eZfX66O0uUgc2741lhTnEeeS5618JV170CxkLeKsmjIR6 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 1- http://safedriving-school.co.uk/css/form/YASSCOMV3_2019/ HTTP 302
- http://safedriving-school.co.uk/css/form/YASSCOMV3_2019/XYSDIRX.php HTTP 302
- http://safedriving-school.co.uk/css/form/YASSCOMV3_2019/d032f72ab557e2386d87bb137b4bdbbf HTTP 301
- http://safedriving-school.co.uk/css/form/YASSCOMV3_2019/d032f72ab557e2386d87bb137b4bdbbf/
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
levendulatunder.hu/ffc/ |
170 B 504 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Cookie set
/
safedriving-school.co.uk/css/form/YASSCOMV3_2019/d032f72ab557e2386d87bb137b4bdbbf/ Redirect Chain
|
285 B 661 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
secureaccount.php
safedriving-school.co.uk/css/form/YASSCOMV3_2019/d032f72ab557e2386d87bb137b4bdbbf/ |
2 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
safedriving-school.co.uk/css/form/YASSCOMV3_2019/d032f72ab557e2386d87bb137b4bdbbf/XYSASSETSX/js/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
xappx.css
safedriving-school.co.uk/css/form/YASSCOMV3_2019/d032f72ab557e2386d87bb137b4bdbbf/XYSASSETSX/css/ |
108 KB 15 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
xsecx.js
safedriving-school.co.uk/css/form/YASSCOMV3_2019/d032f72ab557e2386d87bb137b4bdbbf/XYSASSETSX/js/ |
268 B 490 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
monogram@2x.png
www.paypalobjects.com/images/shared/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
animation-oval.png
www.paypalobjects.com/images/shared/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PayPalSansBig-Light.woff
www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/ |
48 KB 48 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PayPalSansSmall-Light.woff
www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/ |
46 KB 46 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PayPalSansSmall-Regular.woff
www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/ |
46 KB 47 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PayPal (Financial)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| $ function| jQuery1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
safedriving-school.co.uk/ | Name: PHPSESSID Value: nncaa77pgd9pecmaovjpve7r82 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
levendulatunder.hu
safedriving-school.co.uk
www.paypalobjects.com
176.74.27.65
23.210.248.226
91.227.138.36
12bec3e411f30e9f988a001dc06817aef7a8d2513fb2e78c989d75a4946714de
2a2cacf1f67863eedabdf29f70e2ad64391a1a1cb005f722fea3fe5e3c47230d
544dfa59462862db7bafc2d2e4b3925ac3eacb11e52834916df02bd1cda19b1d
5c44069c2a742d12cda3be0d4c90e222389f159d1a83763cb957781789bdec23
843e67ad522a908162007f4b7601819a5bbfef00e38ac7aec778766da8b7b2ab
ae79dcc3eb016922caa1d095cfd936446bc65a46bb3364b242dfc556f7e3c6a8
b6aeb03cbfb0b08ebadf95411cf25170b85ef1a69be24dfc89b2f0382d1e6a98
c599c554590d1a336ffcb9627f6caaac34b6228f60e15f5f25454bff38facb7e
d30b6114fb9496ae46b2a8cdf59379c8ffdb957534bd1dd73e626c7c61c7e67d
fd7b4a21981e9d86de41dba75185c948797d7c4f10944f8a202bee6fe8f03b7b