www.gov.uk.97qfm.com Open in urlscan Pro
41.205.23.46 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.bjengineeringpart.com/contact/
Effective URL:
https://www.gov.uk.97qfm.com/refnd/reclaim.php?wa=wreclaim1.0&rpsnv=13&ct=1544286532&rver=7.0.6737.0&wp=MBI_S...
Submission Tags: 6891708
Submission: On December 15 via api (December 15th 2020, 7:31:18 pm UTC) from NL

Summary HTTP 12 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 12 HTTP transactions. The main IP is 41.205.23.46, located in Cameroon and belongs to MTN-NS-CAMEROON, CM. The main domain is www.gov.uk.97qfm.com.
TLS certificate: Issued by R3 on December 15th 2020. Valid for: 3 months.

This is the only time www.gov.uk.97qfm.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: UK Government (Government)

Domain & IP information

	IP Address		AS Autonomous System
1 1	119.59.99.221 119.59.99.221		56067 (METRABYTE...) (METRABYTE-TH 453 Ladplacout Jorakhaebua)
1 13	41.205.23.46 41.205.23.46		30992 (MTN-NS-CA...) (MTN-NS-CAMEROON)
12	2

1 119.59.99.221 (Bangkok, Thailand) 1 redirects

ASN56067 (METRABYTE-TH 453 Ladplacout Jorakhaebua, TH)
PTR: ns13.sci-nano.com

www.bjengineeringpart.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 41.205.23.46 (Cameroon) 1 redirects

ASN30992 (MTN-NS-CAMEROON, CM)
PTR: host-41.205.23.46.mtn.cm

www.gov.uk.97qfm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	97qfm.com 1 redirects www.gov.uk.97qfm.com	537 KB
1	bjengineeringpart.com 1 redirects www.bjengineeringpart.com	276 B
12	2

	Domain	Requested by
13	www.gov.uk.97qfm.com	1 redirects www.gov.uk.97qfm.com
1	www.bjengineeringpart.com	1 redirects
12	2

This site contains no links.

Subject Issuer	Validity	Valid
www.gov.uk.97qfm.com R3	`2020-12-15` - `2021-03-15`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.gov.uk.97qfm.com/refnd/reclaim.php?wa=wreclaim1.0&rpsnv=13&ct=1544286532&rver=7.0.6737.0&wp=MBI_SSL&https%3a%2f%2foutlook.live.com%2fowa%2f%3fpath%3d%252fmail%252finbox%26nlp%3d1%26RpsCsrfState%3d2689dc6f-4f6e-890d-132c-5db09c03fafc&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015
Frame ID: 1AB1A4B67755B99E95388EE0A62D3AB4
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://www.bjengineeringpart.com/contact/ HTTP 302
https://www.gov.uk.97qfm.com/refnd/?cid HTTP 302
https://www.gov.uk.97qfm.com/refnd/reclaim.php?wa=wreclaim1.0&rpsnv=13&ct=1544286532&rver=7.0... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /php\/?([\d.]+)?/i

CentOS (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /CentOS/i

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

12
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

701 kB
Transfer

698 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.bjengineeringpart.com/contact/ HTTP 302
https://www.gov.uk.97qfm.com/refnd/?cid HTTP 302
https://www.gov.uk.97qfm.com/refnd/reclaim.php?wa=wreclaim1.0&rpsnv=13&ct=1544286532&rver=7.0.6737.0&wp=MBI_SSL&https%3a%2f%2foutlook.live.com%2fowa%2f%3fpath%3d%252fmail%252finbox%26nlp%3d1%26RpsCsrfState%3d2689dc6f-4f6e-890d-132c-5db09c03fafc&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request reclaim.php Show response www.gov.uk.97qfm.com/refnd/ Redirect Chain http://www.bjengineeringpart.com/contact/ https://www.gov.uk.97qfm.com/refnd/?cid https://www.gov.uk.97qfm.com/refnd/reclaim.php?wa=wreclaim1.0&rpsnv=13&ct=1544286532&rver=7.0.6737.0&wp=MBI_SSL&https%3a%2f%2foutlook.live.com%2fowa%2f%3fpath%3d%252fmail%252fin...	7 KB 7 KB	231ms 230ms	Document text/html	41.205.23.46 MTN-NS-CAMEROON
General Check archive.org Show headers Download Go to Full URL https://www.gov.uk.97qfm.com/refnd/reclaim.php?wa=wreclaim1.0&rpsnv=13&ct=1544286532&rver=7.0.6737.0&wp=MBI_SSL&https%3a%2f%2foutlook.live.com%2fowa%2f%3fpath%3d%252fmail%252finbox%26nlp%3d1%26RpsCsrfState%3d2689dc6f-4f6e-890d-132c-5db09c03fafc&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 41.205.23.46 , Cameroon, ASN30992 (MTN-NS-CAMEROON, CM), Reverse DNS host-41.205.23.46.mtn.cm Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.33 / PHP/7.1.33 Resource Hash `6a138523411ef76d90ac2d7111a61dbba2d540381330b1d7c6f3ef13eedc1032` Request headers Host www.gov.uk.97qfm.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 15 Dec 2020 19:25:04 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.33 X-Powered-By PHP/7.1.33 Content-Length 7247 Keep-Alive timeout=5, max=99 Connection Keep-Alive Content-Type text/html; charset=UTF-8 Redirect headers Date Tue, 15 Dec 2020 19:25:03 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.33 X-Powered-By PHP/7.1.33 Location reclaim.php?wa=wreclaim1.0&rpsnv=13&ct=1544286532&rver=7.0.6737.0&wp=MBI_SSL&https%3a%2f%2foutlook.live.com%2fowa%2f%3fpath%3d%252fmail%252finbox%26nlp%3d1%26RpsCsrfState%3d2689dc6f-4f6e-890d-132c-5db09c03fafc&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015 Content-Length 0 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	bootstrap.css www.gov.uk.97qfm.com/refnd/css/	143 KB 143 KB	248ms 247ms	Stylesheet text/css	41.205.23.46 MTN-NS-CAMEROON
General Check archive.org Show headers Download Go to Full URL https://www.gov.uk.97qfm.com/refnd/css/bootstrap.css Requested by Host: www.gov.uk.97qfm.com URL: https://www.gov.uk.97qfm.com/refnd/reclaim.php?wa=wreclaim1.0&rpsnv=13&ct=1544286532&rver=7.0.6737.0&wp=MBI_SSL&https%3a%2f%2foutlook.live.com%2fowa%2f%3fpath%3d%252fmail%252finbox%26nlp%3d1%26RpsCsrfState%3d2689dc6f-4f6e-890d-132c-5db09c03fafc&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 41.205.23.46 , Cameroon, ASN30992 (MTN-NS-CAMEROON, CM), Reverse DNS host-41.205.23.46.mtn.cm Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.33 / Resource Hash `7e630d90c7234b0df1729f62b8f9e4bbfaf293d91a5a0ac46df25f2a6759e39a` Request headers Referer https://www.gov.uk.97qfm.com/refnd/reclaim.php?wa=wreclaim1.0&rpsnv=13&ct=1544286532&rver=7.0.6737.0&wp=MBI_SSL&https%3a%2f%2foutlook.live.com%2fowa%2f%3fpath%3d%252fmail%252finbox%26nlp%3d1%26RpsCsrfState%3d2689dc6f-4f6e-890d-132c-5db09c03fafc&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 15 Dec 2020 19:25:04 GMT Last-Modified Wed, 13 Feb 2019 13:55:16 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.33 ETag "23a5a-581c6e438f900" Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 146010
GET H/1.1	200 OK	claimStyle.css www.gov.uk.97qfm.com/refnd/css/	272 KB 273 KB	806ms 303ms	Stylesheet text/css	41.205.23.46 MTN-NS-CAMEROON
General Check archive.org Show headers Download Go to Full URL https://www.gov.uk.97qfm.com/refnd/css/claimStyle.css Requested by Host: www.gov.uk.97qfm.com URL: https://www.gov.uk.97qfm.com/refnd/reclaim.php?wa=wreclaim1.0&rpsnv=13&ct=1544286532&rver=7.0.6737.0&wp=MBI_SSL&https%3a%2f%2foutlook.live.com%2fowa%2f%3fpath%3d%252fmail%252finbox%26nlp%3d1%26RpsCsrfState%3d2689dc6f-4f6e-890d-132c-5db09c03fafc&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 41.205.23.46 , Cameroon, ASN30992 (MTN-NS-CAMEROON, CM), Reverse DNS host-41.205.23.46.mtn.cm Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.33 / Resource Hash `813d02798ac3784d3f97d5af4595c62bf568f58d50844d8aa9857e7d377995d2` Request headers Referer https://www.gov.uk.97qfm.com/refnd/reclaim.php?wa=wreclaim1.0&rpsnv=13&ct=1544286532&rver=7.0.6737.0&wp=MBI_SSL&https%3a%2f%2foutlook.live.com%2fowa%2f%3fpath%3d%252fmail%252finbox%26nlp%3d1%26RpsCsrfState%3d2689dc6f-4f6e-890d-132c-5db09c03fafc&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 15 Dec 2020 19:25:05 GMT Last-Modified Wed, 13 Feb 2019 13:54:34 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.33 ETag "44136-581c6e1b81a80" Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 278838
GET H/1.1	200 OK	crownLogo.png www.gov.uk.97qfm.com/refnd/images/	1 KB 2 KB	871ms 361ms	Image image/png	41.205.23.46 MTN-NS-CAMEROON
General Check archive.org Show headers Download Go to Show image Full URL https://www.gov.uk.97qfm.com/refnd/images/crownLogo.png Requested by Host: www.gov.uk.97qfm.com URL: https://www.gov.uk.97qfm.com/refnd/reclaim.php?wa=wreclaim1.0&rpsnv=13&ct=1544286532&rver=7.0.6737.0&wp=MBI_SSL&https%3a%2f%2foutlook.live.com%2fowa%2f%3fpath%3d%252fmail%252finbox%26nlp%3d1%26RpsCsrfState%3d2689dc6f-4f6e-890d-132c-5db09c03fafc&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 41.205.23.46 , Cameroon, ASN30992 (MTN-NS-CAMEROON, CM), Reverse DNS host-41.205.23.46.mtn.cm Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.33 / Resource Hash `ea874a79e09423d63420aff44f016fd0b92dc6dec0cc2668d63b150c8669875e` Request headers Referer https://www.gov.uk.97qfm.com/refnd/reclaim.php?wa=wreclaim1.0&rpsnv=13&ct=1544286532&rver=7.0.6737.0&wp=MBI_SSL&https%3a%2f%2foutlook.live.com%2fowa%2f%3fpath%3d%252fmail%252finbox%26nlp%3d1%26RpsCsrfState%3d2689dc6f-4f6e-890d-132c-5db09c03fafc&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 15 Dec 2020 19:25:05 GMT Last-Modified Wed, 13 Feb 2019 13:53:16 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.33 ETag "587-581c6dd11eb00" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 1415
GET H/1.1	200 OK	searchIco.png www.gov.uk.97qfm.com/refnd/images/	3 KB 3 KB	1038ms 392ms	Image image/png	41.205.23.46 MTN-NS-CAMEROON
General Check archive.org Show headers Download Go to Show image Full URL https://www.gov.uk.97qfm.com/refnd/images/searchIco.png Requested by Host: www.gov.uk.97qfm.com URL: https://www.gov.uk.97qfm.com/refnd/reclaim.php?wa=wreclaim1.0&rpsnv=13&ct=1544286532&rver=7.0.6737.0&wp=MBI_SSL&https%3a%2f%2foutlook.live.com%2fowa%2f%3fpath%3d%252fmail%252finbox%26nlp%3d1%26RpsCsrfState%3d2689dc6f-4f6e-890d-132c-5db09c03fafc&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 41.205.23.46 , Cameroon, ASN30992 (MTN-NS-CAMEROON, CM), Reverse DNS host-41.205.23.46.mtn.cm Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.33 / Resource Hash `9e36a152415688f4b1d05fec718708194f4803445971eacecf56cdd1be701cbc` Request headers Referer https://www.gov.uk.97qfm.com/refnd/reclaim.php?wa=wreclaim1.0&rpsnv=13&ct=1544286532&rver=7.0.6737.0&wp=MBI_SSL&https%3a%2f%2foutlook.live.com%2fowa%2f%3fpath%3d%252fmail%252finbox%26nlp%3d1%26RpsCsrfState%3d2689dc6f-4f6e-890d-132c-5db09c03fafc&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 15 Dec 2020 19:25:05 GMT Last-Modified Wed, 13 Feb 2019 13:52:42 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.33 ETag "caf-581c6db0b1e80" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 3247
GET H/1.1	200 OK	logo.png www.gov.uk.97qfm.com/refnd/images/	4 KB 4 KB	309ms 308ms	Image image/png	41.205.23.46 MTN-NS-CAMEROON
General Check archive.org Show headers Download Go to Show image Full URL https://www.gov.uk.97qfm.com/refnd/images/logo.png Requested by Host: www.gov.uk.97qfm.com URL: https://www.gov.uk.97qfm.com/refnd/reclaim.php?wa=wreclaim1.0&rpsnv=13&ct=1544286532&rver=7.0.6737.0&wp=MBI_SSL&https%3a%2f%2foutlook.live.com%2fowa%2f%3fpath%3d%252fmail%252finbox%26nlp%3d1%26RpsCsrfState%3d2689dc6f-4f6e-890d-132c-5db09c03fafc&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 41.205.23.46 , Cameroon, ASN30992 (MTN-NS-CAMEROON, CM), Reverse DNS host-41.205.23.46.mtn.cm Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.33 / Resource Hash `bb9e22aff7881b895c2ceb41d9340804451c474b883f09fe1b4026e76456f44b` Request headers Referer https://www.gov.uk.97qfm.com/refnd/reclaim.php?wa=wreclaim1.0&rpsnv=13&ct=1544286532&rver=7.0.6737.0&wp=MBI_SSL&https%3a%2f%2foutlook.live.com%2fowa%2f%3fpath%3d%252fmail%252finbox%26nlp%3d1%26RpsCsrfState%3d2689dc6f-4f6e-890d-132c-5db09c03fafc&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 15 Dec 2020 19:25:05 GMT Last-Modified Wed, 13 Feb 2019 13:53:00 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.33 ETag "e00-581c6dc1dc700" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 3584
GET H/1.1	404 Not Found	jquery.js www.gov.uk.97qfm.com/refnd/js/	0 0	871ms 362ms	Script text/html	41.205.23.46 MTN-NS-CAMEROON
General Check archive.org Show headers Download Go to Full URL https://www.gov.uk.97qfm.com/refnd/js/jquery.js Requested by Host: www.gov.uk.97qfm.com URL: https://www.gov.uk.97qfm.com/refnd/reclaim.php?wa=wreclaim1.0&rpsnv=13&ct=1544286532&rver=7.0.6737.0&wp=MBI_SSL&https%3a%2f%2foutlook.live.com%2fowa%2f%3fpath%3d%252fmail%252finbox%26nlp%3d1%26RpsCsrfState%3d2689dc6f-4f6e-890d-132c-5db09c03fafc&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 41.205.23.46 , Cameroon, ASN30992 (MTN-NS-CAMEROON, CM), Reverse DNS host-41.205.23.46.mtn.cm Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.33 / Resource Hash Request headers Referer https://www.gov.uk.97qfm.com/refnd/reclaim.php?wa=wreclaim1.0&rpsnv=13&ct=1544286532&rver=7.0.6737.0&wp=MBI_SSL&https%3a%2f%2foutlook.live.com%2fowa%2f%3fpath%3d%252fmail%252finbox%26nlp%3d1%26RpsCsrfState%3d2689dc6f-4f6e-890d-132c-5db09c03fafc&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 15 Dec 2020 19:25:05 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.33 Connection Keep-Alive Keep-Alive timeout=5, max=100 Content-Length 216 Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	bootstrap.js Show response www.gov.uk.97qfm.com/refnd/js/	68 KB 68 KB	871ms 361ms	Script application/javascript	41.205.23.46 MTN-NS-CAMEROON
General Check archive.org Show headers Download Go to Full URL https://www.gov.uk.97qfm.com/refnd/js/bootstrap.js Requested by Host: www.gov.uk.97qfm.com URL: https://www.gov.uk.97qfm.com/refnd/reclaim.php?wa=wreclaim1.0&rpsnv=13&ct=1544286532&rver=7.0.6737.0&wp=MBI_SSL&https%3a%2f%2foutlook.live.com%2fowa%2f%3fpath%3d%252fmail%252finbox%26nlp%3d1%26RpsCsrfState%3d2689dc6f-4f6e-890d-132c-5db09c03fafc&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 41.205.23.46 , Cameroon, ASN30992 (MTN-NS-CAMEROON, CM), Reverse DNS host-41.205.23.46.mtn.cm Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.33 / Resource Hash `0abe8deb334de1ba743b04d0399e99eba336afed9da72fc4c0a302c99f9238c8` Request headers Referer https://www.gov.uk.97qfm.com/refnd/reclaim.php?wa=wreclaim1.0&rpsnv=13&ct=1544286532&rver=7.0.6737.0&wp=MBI_SSL&https%3a%2f%2foutlook.live.com%2fowa%2f%3fpath%3d%252fmail%252finbox%26nlp%3d1%26RpsCsrfState%3d2689dc6f-4f6e-890d-132c-5db09c03fafc&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 15 Dec 2020 19:25:05 GMT Last-Modified Wed, 13 Feb 2019 13:56:40 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.33 ETag "1104b-581c6e93ab600" Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 69707
GET H/1.1	200 OK	person-info-icon.png www.gov.uk.97qfm.com/refnd/images/	23 KB 23 KB	248ms 248ms	Image image/png	41.205.23.46 MTN-NS-CAMEROON
General Check archive.org Show headers Download Go to Show image Full URL https://www.gov.uk.97qfm.com/refnd/images/person-info-icon.png Requested by Host: www.gov.uk.97qfm.com URL: https://www.gov.uk.97qfm.com/refnd/css/claimStyle.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 41.205.23.46 , Cameroon, ASN30992 (MTN-NS-CAMEROON, CM), Reverse DNS host-41.205.23.46.mtn.cm Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.33 / Resource Hash `5fc03b4511dc554ccec764a7a41bc99d12d7c6e2590104a9a0a44e30afd711de` Request headers Referer https://www.gov.uk.97qfm.com/refnd/css/claimStyle.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 15 Dec 2020 19:25:07 GMT Last-Modified Wed, 13 Feb 2019 13:52:34 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.33 ETag "5ab4-581c6da910c80" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 23220
GET H/1.1	200 OK	card-nino-icon.png www.gov.uk.97qfm.com/refnd/images/	5 KB 5 KB	355ms 354ms	Image image/png	41.205.23.46 MTN-NS-CAMEROON
General Check archive.org Show headers Download Go to Show image Full URL https://www.gov.uk.97qfm.com/refnd/images/card-nino-icon.png Requested by Host: www.gov.uk.97qfm.com URL: https://www.gov.uk.97qfm.com/refnd/css/claimStyle.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 41.205.23.46 , Cameroon, ASN30992 (MTN-NS-CAMEROON, CM), Reverse DNS host-41.205.23.46.mtn.cm Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.33 / Resource Hash `555f9031391f2dc41d47dbcfbaaa63d00c6db6e401936df1d02d2132c0573af7` Request headers Referer https://www.gov.uk.97qfm.com/refnd/css/claimStyle.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 15 Dec 2020 19:25:07 GMT Last-Modified Wed, 13 Feb 2019 13:53:24 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.33 ETag "127e-581c6dd8bfd00" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 4734
GET H/1.1	200 OK	time-clock-icon.png www.gov.uk.97qfm.com/refnd/images/	7 KB 8 KB	322ms 321ms	Image image/png	41.205.23.46 MTN-NS-CAMEROON
General Check archive.org Show headers Download Go to Show image Full URL https://www.gov.uk.97qfm.com/refnd/images/time-clock-icon.png Requested by Host: www.gov.uk.97qfm.com URL: https://www.gov.uk.97qfm.com/refnd/css/claimStyle.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 41.205.23.46 , Cameroon, ASN30992 (MTN-NS-CAMEROON, CM), Reverse DNS host-41.205.23.46.mtn.cm Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.33 / Resource Hash `ff32a36746871d79c8eec74510cddb788f4f952a44e1891e9a297184d48f929e` Request headers Referer https://www.gov.uk.97qfm.com/refnd/css/claimStyle.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 15 Dec 2020 19:25:07 GMT Last-Modified Wed, 13 Feb 2019 13:52:50 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.33 ETag "1d24-581c6db853080" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 7460
GET H/1.1	200 OK	OGL.png www.gov.uk.97qfm.com/refnd/images/	761 B 1 KB	354ms 354ms	Image image/png	41.205.23.46 MTN-NS-CAMEROON
General Check archive.org Show headers Download Go to Show image Full URL https://www.gov.uk.97qfm.com/refnd/images/OGL.png Requested by Host: www.gov.uk.97qfm.com URL: https://www.gov.uk.97qfm.com/refnd/css/claimStyle.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 41.205.23.46 , Cameroon, ASN30992 (MTN-NS-CAMEROON, CM), Reverse DNS host-41.205.23.46.mtn.cm Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.33 / Resource Hash `c1aedc8257961b938b4c7a21a2b0db3f2716dd9ef782cea73110dc69107c9042` Request headers Referer https://www.gov.uk.97qfm.com/refnd/css/claimStyle.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 15 Dec 2020 19:25:07 GMT Last-Modified Wed, 13 Feb 2019 13:54:06 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.33 ETag "2f9-581c6e00cdb80" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 761
GET DATA	200 OK	truncated /	71 KB 71 KB		Font application/font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `01c73d5dd84423dd2fc30aabd1de09a86b36b6de9e2e240d954c09cbb1d97aba` Request headers Origin https://www.gov.uk.97qfm.com Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type application/font-woff
GET DATA	200 OK	truncated /	94 KB 94 KB		Font application/font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `048b93884a1b51d20f2a3140541d450cb6b82c6c2cf69128ea1d09fdd9699f30` Request headers Origin https://www.gov.uk.97qfm.com Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type application/font-woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: UK Government (Government)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.bjengineeringpart.com
www.gov.uk.97qfm.com
119.59.99.221
41.205.23.46
01c73d5dd84423dd2fc30aabd1de09a86b36b6de9e2e240d954c09cbb1d97aba
048b93884a1b51d20f2a3140541d450cb6b82c6c2cf69128ea1d09fdd9699f30
0abe8deb334de1ba743b04d0399e99eba336afed9da72fc4c0a302c99f9238c8
555f9031391f2dc41d47dbcfbaaa63d00c6db6e401936df1d02d2132c0573af7
5fc03b4511dc554ccec764a7a41bc99d12d7c6e2590104a9a0a44e30afd711de
6a138523411ef76d90ac2d7111a61dbba2d540381330b1d7c6f3ef13eedc1032
7e630d90c7234b0df1729f62b8f9e4bbfaf293d91a5a0ac46df25f2a6759e39a
813d02798ac3784d3f97d5af4595c62bf568f58d50844d8aa9857e7d377995d2
9e36a152415688f4b1d05fec718708194f4803445971eacecf56cdd1be701cbc
bb9e22aff7881b895c2ceb41d9340804451c474b883f09fe1b4026e76456f44b
c1aedc8257961b938b4c7a21a2b0db3f2716dd9ef782cea73110dc69107c9042
ea874a79e09423d63420aff44f016fd0b92dc6dec0cc2668d63b150c8669875e
ff32a36746871d79c8eec74510cddb788f4f952a44e1891e9a297184d48f929e