URL: https://necs2u.co.uk/
Submission Tags: phishingrod
Submission: On April 03 via api from DE — Scanned from NL

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 6 HTTP transactions. The main IP is 188.114.96.3, located in Amsterdam, Netherlands and belongs to CLOUDFLARENET, US. The main domain is necs2u.co.uk.
TLS certificate: Issued by GTS CA 1P5 on April 3rd 2024. Valid for: 3 months.
This is the only time necs2u.co.uk was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 188.114.96.3 13335 (CLOUDFLAR...)
2 104.17.24.14 13335 (CLOUDFLAR...)
1 62.233.120.72 20860 (IOMART-AS)
6 4
Apex Domain
Subdomains
Transfer
2 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 237
82 KB
2 necs2u.co.uk
necs2u.co.uk
3 KB
1 titaninternet.co.uk
www.titaninternet.co.uk
5 KB
0 sedoparking.com Failed
sedoparking.com Failed
6 4
Domain Requested by
2 cdnjs.cloudflare.com necs2u.co.uk
cdnjs.cloudflare.com
2 necs2u.co.uk
1 www.titaninternet.co.uk necs2u.co.uk
0 sedoparking.com Failed necs2u.co.uk
6 4

This site contains links to these domains. Also see Links.

Domain
www.titaninternet.co.uk
supportservices.titaninternet.co.uk
my.titaninternet.co.uk
Subject Issuer Validity Valid
necs2u.co.uk
GTS CA 1P5
2024-04-03 -
2024-07-02
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2023-07-03 -
2024-07-02
a year crt.sh
*.titaninternet.co.uk
RapidSSL TLS RSA CA G1
2023-09-21 -
2024-10-13
a year crt.sh

This page contains 1 frames:

Primary Page: https://necs2u.co.uk/
Frame ID: DFE9896626BA0416E68319AF52E8164A
Requests: 6 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Page Statistics

6
Requests

83 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

90 kB
Transfer

117 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
necs2u.co.uk/
4 KB
2 KB
Document
General
Full URL
https://necs2u.co.uk/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eec5302a34cecbbec970258cc1f1ce339c33b4e319e2866670e2fd62b98ca039
Security Headers
Name Value
X-Frame-Options DENY

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language
nl-NL,nl;q=0.9
sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
86eae8a328aa9f8d-AMS
content-encoding
br
content-type
text/html; charset=UTF-8
date
Wed, 03 Apr 2024 17:52:14 GMT
last-modified
Wed, 11 Aug 2021 17:32:31 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Fse6HMVYzHHtoAAv6MwSFV816a3if4ixcaPXtMxR257kxHltuXbfwESLg8vtj71OZWS%2Fsx2bTxs4qKgy%2Bz0hILkdh8Dcotp2iEpmIu0TT1sm%2BI%2FPfCz0yBbf%2F4Xp1rs%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
x-frame-options
DENY
font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/
30 KB
6 KB
Stylesheet
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
Requested by
Host: necs2u.co.uk
URL: https://necs2u.co.uk/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://necs2u.co.uk/
accept-language
nl-NL,nl;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Apr 2024 17:52:14 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
1194546
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
5631
last-modified
Mon, 04 May 2020 16:10:07 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e5f-7918"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XzyYcmeUXtdnnxX1rBbTYN1%2FPWSzWOM5qnYceOEaNFFRkIV%2B3jjey2YSHRQucU1VsLUjBivRL0nxSLrkik97B9NE91nHCNHYfX5Ga1RMgATx03MNL9dImm3dllzOetjwcmbKwt8K"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
86eae949dd4c6627-AMS
expires
Mon, 24 Mar 2025 17:52:14 GMT
titan-logo.png
www.titaninternet.co.uk/resources/images/
4 KB
5 KB
Image
General
Full URL
https://www.titaninternet.co.uk/resources/images/titan-logo.png
Requested by
Host: necs2u.co.uk
URL: https://necs2u.co.uk/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
62.233.120.72 , United Kingdom, ASN20860 (IOMART-AS, GB),
Reverse DNS
iomart.com
Software
nginx /
Resource Hash
317105725c35221fefdd6a57f4fe53bf57934d7e20dd640fd6a3946272b70be8
Security Headers
Name Value
Content-Security-Policy connect-src *; default-src 'self'; font-src * data:; frame-src *; img-src * data:; media-src * blob:; object-src *; script-src * blob: 'unsafe-inline' 'unsafe-eval'; style-src * 'unsafe-inline';
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://necs2u.co.uk/
accept-language
nl-NL,nl;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Apr 2024 17:52:14 GMT
content-security-policy
connect-src *; default-src 'self'; font-src * data:; frame-src *; img-src * data:; media-src * blob:; object-src *; script-src * blob: 'unsafe-inline' 'unsafe-eval'; style-src * 'unsafe-inline';
referrer-policy
strict-origin
strict-transport-security
max-age=31536000; includeSubdomains; preload
last-modified
Thu, 17 Oct 2019 10:29:57 GMT
server
nginx
x-content-type-options
nosniff
etag
"1037-59518b2ea3340"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=2592000, private
accept-ranges
bytes
content-length
4151
x-xss-protection
1; mode=block
expires
Fri, 03 May 2024 17:52:14 GMT
park.js
sedoparking.com/frmpark/necs2u.co.uk/titaninternet/
0
0

fontawesome-webfont.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/fonts/
75 KB
76 KB
Font
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by
Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
Origin
https://necs2u.co.uk
accept-language
nl-NL,nl;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Apr 2024 17:52:14 GMT
strict-transport-security
max-age=15780000
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
916390
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
77160
last-modified
Mon, 04 May 2020 16:10:07 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e5f-12d68"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hDRWX84Wt31U%2ByxvvWwMQLdicq4MIUXlJL4MWDkFfYhesZkd9IuzuNiPWZ%2BwX5B9fgN3%2BtJMxL8RWSq4GVJaR858Qh1jPdWHxdzD1rIXdx%2Bc4oM7WuLLCoix3OidvpLP3wb3AflS"}],"group":"cf-nel","max_age":604800}
content-type
application/octet-stream; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
86eae94a59f20a67-AMS
expires
Mon, 24 Mar 2025 17:52:14 GMT
favicon.ico
necs2u.co.uk/
4 KB
2 KB
Other
General
Full URL
https://necs2u.co.uk/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eec5302a34cecbbec970258cc1f1ce339c33b4e319e2866670e2fd62b98ca039
Security Headers
Name Value
X-Frame-Options DENY

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://necs2u.co.uk/
accept-language
nl-NL,nl;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Apr 2024 17:52:22 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 11 Aug 2021 17:32:31 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-frame-options
DENY
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GS1%2Bih74hAIE0cmCgFlAvUFkOQcaLHdN0qHmseWJY7eycYD0NQXiVgdhaVFWx3L%2BgLTqWg%2FSS7LyXWV%2Fezdv7pW%2FoXpQDHB%2FNwlUHSjogQ36EdElnY47yvSI%2BWbO5Ms%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
cache-control
max-age=14400
cf-ray
86eae95d4d289f8d-AMS
alt-svc
h3=":443"; ma=86400

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
sedoparking.com
URL
https://sedoparking.com/frmpark/necs2u.co.uk/titaninternet/park.js

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

5 Console Messages

Source Level URL
Text
rendering warning URL: https://necs2u.co.uk/(Line 84)
Message:
Error parsing a meta element's content: ';' is not a valid key-value pair separator. Please use ',' instead.
javascript warning URL: https://necs2u.co.uk/(Line 108)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://sedoparking.com/frmpark/necs2u.co.uk/titaninternet/park.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://necs2u.co.uk/(Line 108)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://sedoparking.com/frmpark/necs2u.co.uk/titaninternet/park.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network error URL: https://sedoparking.com/frmpark/necs2u.co.uk/titaninternet/park.js
Message:
Failed to load resource: net::ERR_CONNECTION_CLOSED
network error URL: https://necs2u.co.uk/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Frame-Options DENY