login.okta.thebadguy.xyz

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 6 HTTP transactions. The main IP is 104.248.233.162, located in North Bergen, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is login.okta.thebadguy.xyz.
TLS certificate: Issued by R3 on October 31st 2023. Valid for: 3 months.

This is the only time login.okta.thebadguy.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Okta (Online)

Domain & IP information

	IP Address		AS Autonomous System
6	104.248.233.162 104.248.233.162		14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
6	2

6 104.248.233.162 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)

login.okta.thebadguy.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	thebadguy.xyz login.okta.thebadguy.xyz	391 KB
6	1

	Domain	Requested by
6	login.okta.thebadguy.xyz	login.okta.thebadguy.xyz
6	1

This site contains links to these domains. Also see Links.

Domain
support.okta.thebadguy.xyz
www.okta.thebadguy.xyz

Subject Issuer	Validity	Valid
login.okta.thebadguy.xyz R3	`2023-10-31` - `2024-01-29`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://login.okta.thebadguy.xyz/
Frame ID: D725C2C93CB9CFC586607A33897ADAEC
Requests: 5 HTTP requests in this frame

Frame: https://login.okta.thebadguy.xyz/discovery/iframe.html
Frame ID: D204A3D4ABBE8D4193BCC377BA9FF461
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Okta Account Chooser

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

391 kB
Transfer

389 kB
Size

0
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://support.okta.thebadguy.xyz/help/s/sign-in-url
Title: Don't know your sign-in URL?

Search URL Search Domain Scan URL

URL: https://www.okta.thebadguy.xyz/
Title: Okta

Search URL Search Domain Scan URL

URL: https://www.okta.thebadguy.xyz/privacy
Title: Privacy Policy

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response login.okta.thebadguy.xyz/	4 KB 4 KB	631ms 215ms	Document text/html	104.248.233.162 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://login.okta.thebadguy.xyz/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 104.248.233.162 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software AmazonS3 / Resource Hash `269f6d1a0ab66f6c0ba7a7e720279c290d554ec925b65b7f152980dd837facc3` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Age 53276 Cache-Control no-cache, no-store Connection close Content-Type text/html Date Mon, 30 Oct 2023 11:21:54 GMT Etag "2604f7da148f728c4bffe28d55c65a57" Last-Modified Thu, 01 Jun 2023 17:31:03 GMT Server AmazonS3 Transfer-Encoding chunked Via 1.1 f28d01ff99a9babe0b725f1873c60b2a.cloudfront.net (CloudFront) X-Amz-Cf-Id VkSFd4DAF341LJD5r5Z_znOXgrBKvucXVrhaHUmLLko303TE9ZpD8A== X-Amz-Cf-Pop EWR53-C3 X-Cache Hit from cloudfront
GET H/1.1	200 OK	okta-sign-in.css login.okta.thebadguy.xyz/css/	19 KB 19 KB	418ms 210ms	Stylesheet text/css	104.248.233.162 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://login.okta.thebadguy.xyz/css/okta-sign-in.css?88dc7396afa19c320b05 Requested by Host: login.okta.thebadguy.xyz URL: https://login.okta.thebadguy.xyz/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 104.248.233.162 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software AmazonS3 / Resource Hash `a1971d58c567472e2b0043537bd4f046f23b553b64e7fe4a75c44ebbda387c91` Request headers accept-language de-DE,de;q=0.9 Referer https://login.okta.thebadguy.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers Date Mon, 30 Oct 2023 08:28:13 GMT Via 1.1 f28d01ff99a9babe0b725f1873c60b2a.cloudfront.net (CloudFront) Last-Modified Thu, 01 Jun 2023 17:31:02 GMT Server AmazonS3 Age 63691 X-Amz-Cf-Pop EWR53-C3 Etag "9efbad17eac57c3582c32848eb16bc88" Transfer-Encoding chunked X-Cache Hit from cloudfront Content-Type text/css Connection close X-Amz-Cf-Id tNOEC9zB21RbfFleo0TbB2osNZJh8q50KhAuv2QUAOl4AVVm_7OKMg==
GET H/1.1	200 OK	myOkta-88dc7396afa19c320b05.min.js Show response login.okta.thebadguy.xyz/lib/	265 KB 266 KB	560ms 351ms	Script application/javascript	104.248.233.162 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://login.okta.thebadguy.xyz/lib/myOkta-88dc7396afa19c320b05.min.js Requested by Host: login.okta.thebadguy.xyz URL: https://login.okta.thebadguy.xyz/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 104.248.233.162 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software AmazonS3 / Resource Hash `0e3c501dc08a1406dcd44629734697368936c3ec183b73ccadbbd1acb2d23bbd` Request headers accept-language de-DE,de;q=0.9 Referer https://login.okta.thebadguy.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers Date Mon, 30 Oct 2023 13:01:46 GMT Via 1.1 f28d01ff99a9babe0b725f1873c60b2a.cloudfront.net (CloudFront) Last-Modified Thu, 01 Jun 2023 17:31:03 GMT Server AmazonS3 Age 47290 X-Amz-Cf-Pop EWR53-C3 Etag "8414fba90f200c0df742c88c46abc4b3" Transfer-Encoding chunked X-Cache Hit from cloudfront Content-Type application/javascript Cache-Control no-cache, no-store Connection close X-Amz-Cf-Id X5TjrbWu5hCN7NMCzV6EXT0iw32EV0Fq9zh38-xaKAz2aIj_i9di5w==
GET H/1.1	200 OK	logo_okta.png login.okta.thebadguy.xyz/img/	4 KB 4 KB	467ms 254ms	Image image/png	104.248.233.162 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://login.okta.thebadguy.xyz/img/logo_okta.png Requested by Host: login.okta.thebadguy.xyz URL: https://login.okta.thebadguy.xyz/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 104.248.233.162 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software AmazonS3 / Resource Hash `44aacfff588e352ebd03bdff6f974b6375b2831d1c3bc356e541ee79769512cd` Request headers accept-language de-DE,de;q=0.9 Referer https://login.okta.thebadguy.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers Date Mon, 30 Oct 2023 08:28:03 GMT Via 1.1 f28d01ff99a9babe0b725f1873c60b2a.cloudfront.net (CloudFront) Last-Modified Thu, 01 Jun 2023 17:31:03 GMT Server AmazonS3 Age 63701 X-Amz-Cf-Pop EWR53-C3 Etag "861bd280939fb9168caef4de25e3e043" Transfer-Encoding chunked X-Cache Hit from cloudfront Content-Type image/png Connection close X-Amz-Cf-Id NX1M8VrAhYiKD6160wH2E6WqDjst1xUy3zV0jmEXMlcxNbgklQRvpQ==
GET H/1.1	200 OK	iframe.html Show response login.okta.thebadguy.xyz/discovery/ Frame D204	451 B 940 B	427ms 213ms	Document text/html	104.248.233.162 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://login.okta.thebadguy.xyz/discovery/iframe.html Requested by Host: login.okta.thebadguy.xyz URL: https://login.okta.thebadguy.xyz/lib/myOkta-88dc7396afa19c320b05.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 104.248.233.162 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software AmazonS3 / Resource Hash `312961c3e2abd191b80c96dc095382f8a09226a70ea00dbccc20ee26a67ced59` Request headers Referer https://login.okta.thebadguy.xyz/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Age 47810 Cache-Control no-cache, no-store Connection close Content-Type text/html Date Mon, 30 Oct 2023 14:13:37 GMT Etag "f8b177440411e7269b647ae1012388bb" Last-Modified Thu, 01 Jun 2023 17:31:02 GMT Server AmazonS3 Transfer-Encoding chunked Via 1.1 29cdae592cbcdf154c4515153175497e.cloudfront.net (CloudFront) X-Amz-Cf-Id BKLZir4Fda_2LsYe1vTsd4eJmapEgBPZUyleFSa6VafXN_AtDtkOGg== X-Amz-Cf-Pop EWR53-C3 X-Cache Hit from cloudfront
GET H/1.1	200 OK	discoveryIframe-88dc7396afa19c320b05.min.js Show response login.okta.thebadguy.xyz/lib/ Frame D204	96 KB 96 KB	465ms 254ms	Script application/javascript	104.248.233.162 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://login.okta.thebadguy.xyz/lib/discoveryIframe-88dc7396afa19c320b05.min.js Requested by Host: login.okta.thebadguy.xyz URL: https://login.okta.thebadguy.xyz/discovery/iframe.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 104.248.233.162 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software AmazonS3 / Resource Hash `41cded79b468d4aef81fa514f44ce07907e410dfa2dbb3126a65151a58a7c6c5` Request headers accept-language de-DE,de;q=0.9 Referer https://login.okta.thebadguy.xyz/discovery/iframe.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers Date Mon, 30 Oct 2023 13:03:48 GMT Via 1.1 29cdae592cbcdf154c4515153175497e.cloudfront.net (CloudFront) Last-Modified Thu, 01 Jun 2023 17:31:03 GMT Server AmazonS3 Age 61892 X-Amz-Cf-Pop EWR53-C3 Etag "19953e3854535d02dccdbf809bacf44a" Transfer-Encoding chunked X-Cache Hit from cloudfront Content-Type application/javascript Cache-Control no-cache, no-store Connection close X-Amz-Cf-Id udvJlGeh0mD7vRz4f5r6uxrbLbYfTVfpPQfNe_CMUmCSHVHVXkzARg==
GET DATA	200 OK	truncated /	877 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `95915f8e958a3cb8004c554e0ce6af472fbfb95434d026b45eb72a3801f3e0a8` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers Content-Type image/svg+xml

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Okta (Online)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

login.okta.thebadguy.xyz
104.248.233.162
0e3c501dc08a1406dcd44629734697368936c3ec183b73ccadbbd1acb2d23bbd
269f6d1a0ab66f6c0ba7a7e720279c290d554ec925b65b7f152980dd837facc3
312961c3e2abd191b80c96dc095382f8a09226a70ea00dbccc20ee26a67ced59
41cded79b468d4aef81fa514f44ce07907e410dfa2dbb3126a65151a58a7c6c5
44aacfff588e352ebd03bdff6f974b6375b2831d1c3bc356e541ee79769512cd
95915f8e958a3cb8004c554e0ce6af472fbfb95434d026b45eb72a3801f3e0a8
a1971d58c567472e2b0043537bd4f046f23b553b64e7fe4a75c44ebbda387c91

login.okta.thebadguy.xyz Open in urlscan Pro 104.248.233.162 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

6 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

391 kBTransfer

389 kBSize

0 Cookies

3 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

13 JavaScript Global Variables

0 Cookies

Indicators

login.okta.thebadguy.xyz Open in urlscan Pro
104.248.233.162 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

391 kB
Transfer

389 kB
Size

0
Cookies

6 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!