sit-support.cleanairzonevehiclecheck.co.uk
Open in
urlscan Pro
3.9.48.154
Malicious Activity!
Public Scan
Submission: On June 15 via automatic, source openphish
Summary
TLS certificate: Issued by Amazon on July 14th 2020. Valid for: a year.
This is the only time sit-support.cleanairzonevehiclecheck.co.uk was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: UK Government (Government)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
6 | 3.9.48.154 3.9.48.154 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2600:9000:211... 2600:9000:211e:8000:e:3706:bd00:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2a00:1450:400... 2a00:1450:4001:82f::2008 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2001:470:6e0a... 2001:470:6e0a::1b:243 | 6939 (HURRICANE) (HURRICANE) | |
9 | 4 |
ASN16509 (AMAZON-02, US)
PTR: ec2-3-9-48-154.eu-west-2.compute.amazonaws.com
sit-support.cleanairzonevehiclecheck.co.uk |
ASN16509 (AMAZON-02, US)
cc.cdn.civiccomputing.com |
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
cleanairzonevehiclecheck.co.uk
sit-support.cleanairzonevehiclecheck.co.uk |
109 KB |
2 |
civiccomputing.com
cc.cdn.civiccomputing.com apikeys.civiccomputing.com |
69 KB |
1 |
googletagmanager.com
www.googletagmanager.com |
30 KB |
9 | 3 |
Domain | Requested by | |
---|---|---|
6 | sit-support.cleanairzonevehiclecheck.co.uk |
sit-support.cleanairzonevehiclecheck.co.uk
|
1 | apikeys.civiccomputing.com |
cc.cdn.civiccomputing.com
|
1 | www.googletagmanager.com |
sit-support.cleanairzonevehiclecheck.co.uk
|
1 | cc.cdn.civiccomputing.com |
sit-support.cleanairzonevehiclecheck.co.uk
|
9 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.gov.uk |
www.nationalarchives.gov.uk |
Subject Issuer | Validity | Valid | |
---|---|---|---|
sit-support.cleanairzonevehiclecheck.co.uk Amazon |
2020-07-14 - 2021-08-14 |
a year | crt.sh |
*.cdn.civiccomputing.com Amazon |
2020-11-21 - 2021-12-20 |
a year | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2021-05-17 - 2021-08-09 |
3 months | crt.sh |
apikeys.civiccomputing.com R3 |
2021-04-29 - 2021-07-28 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://sit-support.cleanairzonevehiclecheck.co.uk/
Frame ID: B26170C8C9F44D501A382642627C4400
Requests: 9 HTTP requests in this frame
Screenshot
Detected technologies
Ruby (Programming Languages) ExpandDetected patterns
- meta csrf-param /^authenticity_token$/i
Ruby on Rails (Web Frameworks) Expand
Detected patterns
- meta csrf-param /^authenticity_token$/i
Google Tag Manager (Tag Managers) Expand
Detected patterns
- html /<!-- (?:End )?Google Tag Manager -->/i
Page Statistics
3 Outgoing links
These are links going to different origins than the main page.
Title: GOV.UK
Search URL Search Domain Scan URL
Title: Open Government Licence v3.0,
Search URL Search Domain Scan URL
Title: © Crown copyright
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
sit-support.cleanairzonevehiclecheck.co.uk/ |
13 KB 14 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
application-4157ba70.css
sit-support.cleanairzonevehiclecheck.co.uk/packs/css/ |
150 KB 15 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cookieControl-9.1.min.js
cc.cdn.civiccomputing.com/9/ |
245 KB 68 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
application-9d1df875efb3fca227e9.js
sit-support.cleanairzonevehiclecheck.co.uk/packs/js/ |
51 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gtm.js
www.googletagmanager.com/ |
75 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
v
apikeys.civiccomputing.com/c/ |
533 B 1 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
govuk-crest.png
sit-support.cleanairzonevehiclecheck.co.uk/packs/media/images/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bold-b542beb274-v2.woff2
sit-support.cleanairzonevehiclecheck.co.uk/packs/media/fonts/ |
31 KB 31 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
light-94a07e06a1-v2.woff2
sit-support.cleanairzonevehiclecheck.co.uk/packs/media/fonts/ |
33 KB 33 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: UK Government (Government)28 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| dataLayer function| setImmediate function| clearImmediate object| regeneratorRuntime object| CookieControl string| gaID string| apiKey string| product string| serviceName string| cookiesPath string| introText string| necessaryDescription string| cookiesDescription function| hideAcceptButton object| config boolean| _rails_loaded object| google_tag_manager1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
sit-support.cleanairzonevehiclecheck.co.uk/ | Name: _customer_service_session Value: a114009a82b8c79c22087cb3aaf55449 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | default-src 'none'; font-src 'self' https: data:; img-src 'self' https:; object-src 'none'; script-src 'self' https: 'unsafe-inline'; style-src 'self' https: 'unsafe-inline'; connect-src 'self' https:; frame-src https://www.googletagmanager.com; frame-ancestors 'none' |
Strict-Transport-Security | max-age=31536000 |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
apikeys.civiccomputing.com
cc.cdn.civiccomputing.com
sit-support.cleanairzonevehiclecheck.co.uk
www.googletagmanager.com
2001:470:6e0a::1b:243
2600:9000:211e:8000:e:3706:bd00:93a1
2a00:1450:4001:82f::2008
3.9.48.154
06eba01b1af0f4014b484c711771fef1db30becbf0edf481498da1e4958d3d47
29032558fb2cf9d777899b328fb94d9078c70e8b88b7c96dea5738426eb49d8c
330cb31e1f3d9d15144658470d19009f7c263021395d661d8da3d0cd3b1ae0d4
5697f7bedf85eb155f6a8973a1c38ee5a9039278f260fcbd89c9ab58eab192b1
69695cd69b435a90d7f92bf0cf766069aa5fcf035386ec93754449753980f03c
9dbff47394cbc7c99cf02674b2bea14f3478f3d7f479d89d55939a616947dc47
bb9e22aff7881b895c2ceb41d9340804451c474b883f09fe1b4026e76456f44b
eedfb3c2f7945caebd0b15522b59d6c7f01be17fecd6102fd76452ad4042f7b0
f708128cf027eca2b04d4c5ec9421e4909b18f3212545350c2adeb574bbfb011