bttl.ir
Open in
urlscan Pro
172.67.201.209
Public Scan
Effective URL: https://bttl.ir/page.php
Submission Tags: @phish_report
Submission: On January 11 via api from FI — Scanned from FI
Summary
TLS certificate: Issued by WE1 on January 8th 2025. Valid for: 3 months.
This is the only time bttl.ir was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 12 | 172.67.201.209 172.67.201.209 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
11 | 1 |
Domain | Requested by | |
---|---|---|
12 | bttl.ir |
1 redirects
bttl.ir
|
11 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
bttl.ir WE1 |
2025-01-08 - 2025-04-08 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://bttl.ir/page.php
Frame ID: E103A43F7D48265F2CFA9E62F0AAD7CD
Requests: 11 HTTP requests in this frame
Screenshot
Page Title
سامانه احراز هویت ثنا | Sana AuthenticationPage URL History Show full URLs
-
https://bttl.ir/
HTTP 302
https://bttl.ir/page.php Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Bootstrap (Web Frameworks) Expand
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
SweetAlert (JavaScript Libraries) Expand
Detected patterns
- sweet(?:-)?alert(?:\.min)?\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://bttl.ir/
HTTP 302
https://bttl.ir/page.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
page.php
bttl.ir/ Redirect Chain
|
6 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bootstrap-theme.min.css
bttl.ir/css/ |
119 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
font-awesome.min.css
bttl.ir/css/ |
27 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
styles.css
bttl.ir/css/ |
17 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.min.js
bttl.ir/css/ |
94 KB 37 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
sweetalert.min.js
bttl.ir/css/ |
40 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo.png
bttl.ir/img/ |
5 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bg-72679b689e8ccbc15b4fca2f298ff279416da209.jpg
bttl.ir/img/ |
236 KB 167 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
JudFont-ff0736fe528c1ed5d66450589488779ee0915ac5.woff
bttl.ir/css/ |
60 KB 61 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
iranyekanwebbold-e587713a2dc5102ec7444ab2d10859e6974e3a82.woff
bttl.ir/css/ |
32 KB 32 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
bttl.ir/ |
138 B 736 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| setImmediate function| clearImmediate function| swal function| sweetAlert0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bttl.ir
172.67.201.209
2ac46ebee46d515be86deeba385b4e41f8cff160364b362c9a6e153df327c66b
301bd9f16f94feedfae7a946a14bac38cb73c43efe6117bc5586835af03d7d6f
61a28bcb3ceea2a24f003217898e459f078017974584adf324ec0ca86fa587c7
70788f022cbbefea467e43b2921ea5ff0597549d6a446252274855d18817979c
8950daa3d19518cb44818db78f28b9641eeb03948255ec72dd02b6ea580d6edf
965e0e3d0b6e9d05df39fce519267bd202b3f4d1f28c4d2d8b27fd46297d93fb
aec3d419d50f05781a96f223e18289aeb52598b5db39be82a7b71dc67d6a7947
bed9331162c3c70bad8c954c5929403653ec6613c40845da9065250d91647b6c
d8bf6e578725fe0e6001e66aa7c83e2b5111a70d09c061ebcd1f348b1db4f1c2
dc29de75875c80e20715cea656491d86523c2375e50d3a1417e134ee79701c81
fbd15de0e5a080208cbce1f9a9c32212ca4de06d351339d0940619442b6dbc7b