test.bcitech.com Open in urlscan Pro
64.29.151.221  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set / Show response test.bcitech.com/profiles/minimal/780124435960781206685369172031169852364079820/reply/	2 KB 3 KB	15991ms 429ms	Document text/html	64.29.151.221 InternetNamesForB...
General Check archive.org Show headers Download Go to Full URL http://test.bcitech.com/profiles/minimal/780124435960781206685369172031169852364079820/reply/ Protocol HTTP/1.1 Server 64.29.151.221 , United States, ASN30447 (INFB2-AS - InternetNamesForBusiness.com, US), Reverse DNS hostedc40.carrierzone.com Software / Resource Hash b57c82f2acc21f5110d90a3fcf783ff212b9516d84e946882a37bed2499d488a Security Headers Name Value X-Content-Type-Options nosniff Request headers Host test.bcitech.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 16 Aug 2019 22:52:53 GMT X-Content-Type-Options nosniff Content-Length 2505 Keep-Alive timeout=10, max=100 Connection Keep-Alive Content-Type text/html; charset=UTF-8 Set-Cookie TS0194eee0=010bd78044b5dac05736cb875ae3c5a508db26618d0b9002107342b4ac7ffcb0513155d463736a5ea602aa0c96a6ac227e8a97c9df; Path=/
GET H/1.1	200 OK	log.css test.bcitech.com/profiles/minimal/780124435960781206685369172031169852364079820/reply/cs/xBanana/lib/css/	76 KB 77 KB	227ms 224ms	Stylesheet text/css	64.29.151.221 InternetNamesForB...
General Check archive.org Show headers Download Go to Full URL http://test.bcitech.com/profiles/minimal/780124435960781206685369172031169852364079820/reply/cs/xBanana/lib/css/log.css Requested by Host: test.bcitech.com URL: http://test.bcitech.com/profiles/minimal/780124435960781206685369172031169852364079820/reply/ Protocol HTTP/1.1 Security , , Server 64.29.151.221 , United States, ASN30447 (INFB2-AS - InternetNamesForBusiness.com, US), Reverse DNS hostedc40.carrierzone.com Software / Resource Hash 182717d4e386cc3da173cad4562b61bd2cd9ef8bdcc19d7c7ca4c89254c1c340 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer http://test.bcitech.com/profiles/minimal/780124435960781206685369172031169852364079820/reply/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 16 Aug 2019 22:52:53 GMT X-Content-Type-Options nosniff Last-Modified Wed, 14 Aug 2019 20:07:41 GMT Content-Type text/css Cache-Control max-age=1209600 Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=10, max=200 Content-Length 78318 Expires Fri, 30 Aug 2019 22:52:53 GMT
GET H2	200	api.js Show response www.google.com/recaptcha/	762 B 698 B	35ms 16ms	Script text/javascript	2a00:1450:4001:820::2004 Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api.js Requested by Host: test.bcitech.com URL: http://test.bcitech.com/profiles/minimal/780124435960781206685369172031169852364079820/reply/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software GSE / Resource Hash b4550cb01eb4323b99753effaddbe85cf44ebfa3bb6763b62448594d30ef3ffb Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer http://test.bcitech.com/profiles/minimal/780124435960781206685369172031169852364079820/reply/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 16 Aug 2019 22:52:53 GMT content-encoding gzip x-content-type-options nosniff server GSE x-frame-options SAMEORIGIN content-type text/javascript; charset=UTF-8 status 200 cache-control private, max-age=300 alt-svc quic=":443"; ma=2592000; v="46,43,39" content-length 448 x-xss-protection 1; mode=block expires Fri, 16 Aug 2019 22:52:53 GMT
GET H/1.1	200 OK	pp.svg test.bcitech.com/profiles/minimal/780124435960781206685369172031169852364079820/reply/cs/xBanana/lib/img/	4 KB 5 KB	591ms 589ms	Image image/svg+xml	64.29.151.221 InternetNamesForB...
General Check archive.org Show headers Download Go to Show image Full URL http://test.bcitech.com/profiles/minimal/780124435960781206685369172031169852364079820/reply/cs/xBanana/lib/img/pp.svg Requested by Host: test.bcitech.com URL: http://test.bcitech.com/profiles/minimal/780124435960781206685369172031169852364079820/reply/ Protocol HTTP/1.1 Security , , Server 64.29.151.221 , United States, ASN30447 (INFB2-AS - InternetNamesForBusiness.com, US), Reverse DNS hostedc40.carrierzone.com Software / Resource Hash 85816cdb3190281e1d4ce7ef9bb5688a68ed4e1d43fa366ba2197680e528e490 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer http://test.bcitech.com/profiles/minimal/780124435960781206685369172031169852364079820/reply/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 16 Aug 2019 22:52:53 GMT X-Content-Type-Options nosniff Last-Modified Wed, 14 Aug 2019 20:07:41 GMT ETag "114e-590194f3b0a7b" Content-Type image/svg+xml Cache-Control max-age=1209600 Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=10, max=100 Content-Length 4430 Expires Fri, 30 Aug 2019 22:52:53 GMT
GET H2	200	recaptcha__en.js Show response www.gstatic.com/recaptcha/api2/v1563777128698/	263 KB 92 KB	18ms 6ms	Script text/javascript	2a00:1450:4001:809::2003 Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/recaptcha/api2/v1563777128698/recaptcha__en.js Requested by Host: www.google.com URL: https://www.google.com/recaptcha/api.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software sffe / Resource Hash d3aeafa2a7a1cc171df8d7311d7ae69916a46ca07e67151b55e1ee24dc8871bc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer http://test.bcitech.com/profiles/minimal/780124435960781206685369172031169852364079820/reply/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 16 Aug 2019 13:03:55 GMT content-encoding gzip x-content-type-options nosniff last-modified Mon, 22 Jul 2019 17:45:00 GMT server sffe age 35339 vary Accept-Encoding content-type text/javascript status 200 cache-control public, max-age=31536000 accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="46,43,39" content-length 94063 x-xss-protection 0 expires Sat, 15 Aug 2020 13:03:55 GMT
GET H/1.1	200 OK	bck.jpeg test.bcitech.com/profiles/minimal/780124435960781206685369172031169852364079820/reply/cs/xBanana/lib/img/	156 KB 157 KB	211ms 211ms	Image image/jpeg	64.29.151.221 InternetNamesForB...
General Check archive.org Show headers Download Go to Show image Full URL http://test.bcitech.com/profiles/minimal/780124435960781206685369172031169852364079820/reply/cs/xBanana/lib/img/bck.jpeg Requested by Host: test.bcitech.com URL: http://test.bcitech.com/profiles/minimal/780124435960781206685369172031169852364079820/reply/ Protocol HTTP/1.1 Security , , Server 64.29.151.221 , United States, ASN30447 (INFB2-AS - InternetNamesForBusiness.com, US), Reverse DNS hostedc40.carrierzone.com Software / Resource Hash 19455abeb5d16262ebc0ad8c9d07c8e7832510dabc6bc821937b7e22b51c5004 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer http://test.bcitech.com/profiles/minimal/780124435960781206685369172031169852364079820/reply/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 16 Aug 2019 22:52:54 GMT X-Content-Type-Options nosniff Last-Modified Wed, 14 Aug 2019 20:07:41 GMT Content-Type image/jpeg Cache-Control max-age=1209600 Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=10, max=199 Content-Length 159976 Expires Fri, 30 Aug 2019 22:52:54 GMT
GET H2	200	anchor www.google.com/recaptcha/api2/ Frame AADE	0 0	35ms 35ms	Document text/html	2a00:1450:4001:820::2004 Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcXEbMUAAAAAKAZPH25I9-wdclWB_P9hI1Tmylg&co=aHR0cDovL3Rlc3QuYmNpdGVjaC5jb206ODA.&hl=en&v=v1563777128698&size=normal&cb=143hv5471kij Requested by Host: www.gstatic.com URL: https://www.gstatic.com/recaptcha/api2/v1563777128698/recaptcha__en.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software GSE / Resource Hash Security Headers Name Value Content-Security-Policy script-src 'report-sample' 'nonce-bOb1e8crnAqFwgQZLIzJBA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers :method GET :authority www.google.com :scheme https :path /recaptcha/api2/anchor?ar=1&k=6LcXEbMUAAAAAKAZPH25I9-wdclWB_P9hI1Tmylg&co=aHR0cDovL3Rlc3QuYmNpdGVjaC5jb206ODA.&hl=en&v=v1563777128698&size=normal&cb=143hv5471kij pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-mode nested-navigate accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 sec-fetch-site cross-site referer http://test.bcitech.com/profiles/minimal/780124435960781206685369172031169852364079820/reply/ accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode nested-navigate Referer http://test.bcitech.com/profiles/minimal/780124435960781206685369172031169852364079820/reply/ Response headers status 200 content-type text/html; charset=utf-8 cache-control no-cache, no-store, max-age=0, must-revalidate pragma no-cache expires Mon, 01 Jan 1990 00:00:00 GMT date Fri, 16 Aug 2019 22:52:54 GMT content-security-policy script-src 'report-sample' 'nonce-bOb1e8crnAqFwgQZLIzJBA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 content-encoding gzip x-content-type-options nosniff x-xss-protection 1; mode=block content-length 9106 server GSE alt-svc quic=":443"; ma=2592000; v="46,43,39"
GET H2	200	bframe www.google.com/recaptcha/api2/ Frame C46D	0 0	27ms 27ms	Document text/html	2a00:1450:4001:820::2004 Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api2/bframe?hl=en&v=v1563777128698&k=6LcXEbMUAAAAAKAZPH25I9-wdclWB_P9hI1Tmylg&cb=6m9q6pxxj3oo Requested by Host: www.gstatic.com URL: https://www.gstatic.com/recaptcha/api2/v1563777128698/recaptcha__en.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software GSE / Resource Hash Security Headers Name Value Content-Security-Policy script-src 'report-sample' 'nonce-HzjO2+78hmhVroLKoutfXw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers :method GET :authority www.google.com :scheme https :path /recaptcha/api2/bframe?hl=en&v=v1563777128698&k=6LcXEbMUAAAAAKAZPH25I9-wdclWB_P9hI1Tmylg&cb=6m9q6pxxj3oo pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-mode nested-navigate accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 sec-fetch-site cross-site referer http://test.bcitech.com/profiles/minimal/780124435960781206685369172031169852364079820/reply/ accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode nested-navigate Referer http://test.bcitech.com/profiles/minimal/780124435960781206685369172031169852364079820/reply/ Response headers status 200 content-type text/html; charset=utf-8 cache-control no-cache, no-store, max-age=0, must-revalidate pragma no-cache expires Mon, 01 Jan 1990 00:00:00 GMT date Fri, 16 Aug 2019 22:52:54 GMT content-security-policy script-src 'report-sample' 'nonce-HzjO2+78hmhVroLKoutfXw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 content-encoding gzip x-content-type-options nosniff x-xss-protection 1; mode=block content-length 1121 server GSE alt-svc quic=":443"; ma=2592000; v="46,43,39"

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask object| ___grecaptcha_cfg object| grecaptcha boolean| __google_recaptcha_client function| correctCaptcha object| recaptcha object| closure_lm_505317

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

test.bcitech.com
www.google.com
www.gstatic.com
2a00:1450:4001:809::2003
2a00:1450:4001:820::2004
64.29.151.221
182717d4e386cc3da173cad4562b61bd2cd9ef8bdcc19d7c7ca4c89254c1c340
19455abeb5d16262ebc0ad8c9d07c8e7832510dabc6bc821937b7e22b51c5004
85816cdb3190281e1d4ce7ef9bb5688a68ed4e1d43fa366ba2197680e528e490
b4550cb01eb4323b99753effaddbe85cf44ebfa3bb6763b62448594d30ef3ffb
b57c82f2acc21f5110d90a3fcf783ff212b9516d84e946882a37bed2499d488a
d3aeafa2a7a1cc171df8d7311d7ae69916a46ca07e67151b55e1ee24dc8871bc