login.signin.okta-zotecpartners.com Open in urlscan Pro
38.242.21.26  Malicious Activity! Public Scan

3 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response login.signin.okta-zotecpartners.com/	6 KB 6 KB	442ms 172ms	Document text/html	38.242.21.26 RAPID7
General Check archive.org Show headers Download Go to Full URL https://login.signin.okta-zotecpartners.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 38.242.21.26 , United States, ASN395213 (RAPID7, US), Reverse DNS Software AmazonS3 / Resource Hash 59a8b0bc7d8952942911281d7f2ecf371a93524f98939b0bd23576e5d63af408 Request headers Host login.signin.okta-zotecpartners.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Age 42893 Connection close Content-Type text/html Date Mon, 20 Sep 2021 07:04:49 GMT Etag "756250cb840e47e3c885cea01bfccbbb" Last-Modified Thu, 05 Aug 2021 17:56:57 GMT Server AmazonS3 Transfer-Encoding chunked Via 1.1 c0b215a986c6cbf9ca9d8ba3c9583e2c.cloudfront.net (CloudFront) X-Amz-Cf-Id 5xbj1MjTDHZkp6qM9cBvw2zrInbq1YrWCJQqTwlwRe7C91eXKrcqTA== X-Amz-Cf-Pop BOS50-C3 X-Cache Hit from cloudfront
GET H/1.1	200 OK	okta-sign-in.css login.signin.okta-zotecpartners.com/css/	19 KB 19 KB	454ms 182ms	Stylesheet text/css	38.242.21.26 RAPID7
General Check archive.org Show headers Download Go to Full URL https://login.signin.okta-zotecpartners.com/css/okta-sign-in.css?cf31bb36db1690bcb52e Requested by Host: login.signin.okta-zotecpartners.com URL: https://login.signin.okta-zotecpartners.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 38.242.21.26 , United States, ASN395213 (RAPID7, US), Reverse DNS Software AmazonS3 / Resource Hash 3dbb9c87d210506f0eac9ea83d701ed60e459358a430a524f1d77e18e7605c90 Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host login.signin.okta-zotecpartners.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Sec-Fetch-Mode no-cors Accept text/css,*/*;q=0.1 Cache-Control no-cache Sec-Fetch-Dest style Referer https://login.signin.okta-zotecpartners.com/ Connection keep-alive Accept-Language de-DE,de;q=0.9 Referer https://login.signin.okta-zotecpartners.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Mon, 20 Sep 2021 07:22:52 GMT Via 1.1 c0b215a986c6cbf9ca9d8ba3c9583e2c.cloudfront.net (CloudFront) Connection close Last-Modified Thu, 05 Aug 2021 17:56:55 GMT Server AmazonS3 Age 41628 Etag "e61126c5a373eeae0c7d12357252ce02" Transfer-Encoding chunked X-Cache Hit from cloudfront Content-Type text/css X-Edge-Origin-Shield-Skipped 0 X-Amz-Cf-Pop BOS50-C3 X-Amz-Cf-Id wmMDvK2TSTDTm6X8SKY8Mz92t_8mOPTYBbpijicEa5Auhp6BqyWdEg==
GET H/1.1	200 OK	myOkta-a2927f5018e0ae2165cf.min.js Show response login.signin.okta-zotecpartners.com/lib/	254 KB 255 KB	564ms 292ms	Script application/javascript	38.242.21.26 RAPID7
General Check archive.org Show headers Download Go to Full URL https://login.signin.okta-zotecpartners.com/lib/myOkta-a2927f5018e0ae2165cf.min.js Requested by Host: login.signin.okta-zotecpartners.com URL: https://login.signin.okta-zotecpartners.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 38.242.21.26 , United States, ASN395213 (RAPID7, US), Reverse DNS Software AmazonS3 / Resource Hash f169adc171b1a6f3c4ecb33106acbbe638db1a83a62c692d7e8dceb3b30f8994 Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host login.signin.okta-zotecpartners.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Sec-Fetch-Mode no-cors Accept */* Cache-Control no-cache Sec-Fetch-Dest script Referer https://login.signin.okta-zotecpartners.com/ Connection keep-alive Accept-Language de-DE,de;q=0.9 Referer https://login.signin.okta-zotecpartners.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Mon, 20 Sep 2021 10:57:12 GMT Via 1.1 c0b215a986c6cbf9ca9d8ba3c9583e2c.cloudfront.net (CloudFront) Connection close Last-Modified Thu, 05 Aug 2021 17:56:57 GMT Server AmazonS3 Age 29000 Etag "ca69ece6f6e59a57dd01d007fe616bdb" Transfer-Encoding chunked X-Cache Hit from cloudfront Content-Type application/javascript X-Edge-Origin-Shield-Skipped 0 X-Amz-Cf-Pop BOS50-C3 X-Amz-Cf-Id fQLBl9Cio_eOkCdYKgEV5XZMfqQprZoBxI-BVb4tKVgR3bhU6vacrg==
GET H/1.1	200 OK	logo_okta.png login.signin.okta-zotecpartners.com/img/	2 KB 3 KB	447ms 178ms	Image image/png	38.242.21.26 RAPID7
General Check archive.org Show headers Download Go to Show image Full URL https://login.signin.okta-zotecpartners.com/img/logo_okta.png Requested by Host: login.signin.okta-zotecpartners.com URL: https://login.signin.okta-zotecpartners.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 38.242.21.26 , United States, ASN395213 (RAPID7, US), Reverse DNS Software AmazonS3 / Resource Hash 07561b0527818d05bb073cae9d055895924a96bcea0721ac7a0dcb3c3f708af0 Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host login.signin.okta-zotecpartners.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Sec-Fetch-Mode no-cors Accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Cache-Control no-cache Sec-Fetch-Dest image Referer https://login.signin.okta-zotecpartners.com/ Connection keep-alive Accept-Language de-DE,de;q=0.9 Referer https://login.signin.okta-zotecpartners.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Sun, 19 Sep 2021 20:43:14 GMT Via 1.1 5a8470558db8c5018d387c481b2df76a.cloudfront.net (CloudFront) Last-Modified Thu, 05 Aug 2021 17:56:56 GMT Server AmazonS3 Age 79933 Etag "00b28e552573899e15fa6e77278759d5" Transfer-Encoding chunked X-Cache Hit from cloudfront Content-Type image/png Connection close X-Amz-Cf-Pop BOS50-C3 X-Amz-Cf-Id gweDRD_Lbe_mDM4GKPJJNWMsf7tXJ9bBleweC2TOxaqhGU9K8oczSQ==
GET H/1.1	200 OK	iframe.html Show response login.signin.okta-zotecpartners.com/discovery/ Frame 7314	546 B 1 KB	430ms 172ms	Document text/html	38.242.21.26 RAPID7
General Check archive.org Show headers Download Go to Full URL https://login.signin.okta-zotecpartners.com/discovery/iframe.html Requested by Host: login.signin.okta-zotecpartners.com URL: https://login.signin.okta-zotecpartners.com/lib/myOkta-a2927f5018e0ae2165cf.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 38.242.21.26 , United States, ASN395213 (RAPID7, US), Reverse DNS Software AmazonS3 / Resource Hash 893efca8616a32e2315c319fb7e78636634ff77379f7e6220c21ede088ee9f0a Request headers Host login.signin.okta-zotecpartners.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site same-origin Sec-Fetch-Mode navigate Sec-Fetch-Dest iframe Referer https://login.signin.okta-zotecpartners.com/ Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://login.signin.okta-zotecpartners.com/ Response headers Age 26515 Connection close Content-Type text/html Date Mon, 20 Sep 2021 11:33:33 GMT Etag "953e10853c650e0e1662b7e24256ad76" Last-Modified Thu, 05 Aug 2021 17:56:55 GMT Server AmazonS3 Transfer-Encoding chunked Via 1.1 5a8470558db8c5018d387c481b2df76a.cloudfront.net (CloudFront) X-Amz-Cf-Id lKcvALdRaet5uUWu7Aj2YJMvCBkMiI9t7mu0SkkUa200ofiIH9x7QA== X-Amz-Cf-Pop BOS50-C3 X-Cache Hit from cloudfront X-Edge-Origin-Shield-Skipped 0
GET H/1.1	200 OK	discoveryIframe-d662b785a6524906f1db.min.js Show response login.signin.okta-zotecpartners.com/lib/ Frame 7314	96 KB 96 KB	489ms 218ms	Script application/javascript	38.242.21.26 RAPID7
General Check archive.org Show headers Download Go to Full URL https://login.signin.okta-zotecpartners.com/lib/discoveryIframe-d662b785a6524906f1db.min.js Requested by Host: login.signin.okta-zotecpartners.com URL: https://login.signin.okta-zotecpartners.com/discovery/iframe.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 38.242.21.26 , United States, ASN395213 (RAPID7, US), Reverse DNS Software AmazonS3 / Resource Hash 370b459f6f93f1e8aaa02f57ede81b941c1c1656f82d81ea96e3cacf348df112 Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host login.signin.okta-zotecpartners.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Sec-Fetch-Mode no-cors Accept */* Cache-Control no-cache Sec-Fetch-Dest script Referer https://login.signin.okta-zotecpartners.com/discovery/iframe.html Connection keep-alive Accept-Language de-DE,de;q=0.9 Referer https://login.signin.okta-zotecpartners.com/discovery/iframe.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Sun, 19 Sep 2021 21:52:32 GMT Via 1.1 5a8470558db8c5018d387c481b2df76a.cloudfront.net (CloudFront) Last-Modified Thu, 05 Aug 2021 17:56:57 GMT Server AmazonS3 Age 75776 Etag "2c2055024824c671b474d98ba0bab013" Transfer-Encoding chunked X-Cache Hit from cloudfront Content-Type application/javascript Connection close X-Amz-Cf-Pop BOS50-C3 X-Amz-Cf-Id SI-bXVrwjQmMLTYRP-6-g9t1ZxzyjAIDrb7NUJDzylw42dFVAlIhDA==
GET DATA	200 OK	truncated /	877 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 95915f8e958a3cb8004c554e0ce6af472fbfb95434d026b45eb72a3801f3e0a8 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Content-Type image/svg+xml

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Okta (Online)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforexrselect boolean| originAgentCluster function| myOkta object| __core-js_shared__ object| core object| global object| System function| asap function| Observable function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

login.signin.okta-zotecpartners.com
38.242.21.26
07561b0527818d05bb073cae9d055895924a96bcea0721ac7a0dcb3c3f708af0
370b459f6f93f1e8aaa02f57ede81b941c1c1656f82d81ea96e3cacf348df112
3dbb9c87d210506f0eac9ea83d701ed60e459358a430a524f1d77e18e7605c90
59a8b0bc7d8952942911281d7f2ecf371a93524f98939b0bd23576e5d63af408
893efca8616a32e2315c319fb7e78636634ff77379f7e6220c21ede088ee9f0a
95915f8e958a3cb8004c554e0ce6af472fbfb95434d026b45eb72a3801f3e0a8
f169adc171b1a6f3c4ecb33106acbbe638db1a83a62c692d7e8dceb3b30f8994