bill-idsupport.com Open in urlscan Pro
158.160.16.231 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://bill-idsupport.com/
Effective URL:
https://bill-idsupport.com/identifier.php?_sessionid=b24be14463e50e2894ef9b9c6985f91c
Submission: On August 04 via automatic, source certstream-suspicious (August 4th 2023, 4:41:12 pm UTC) — Scanned from DE

Summary HTTP 11 Redirects Links 37 Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 11 HTTP transactions. The main IP is 158.160.16.231, located in Moscow, Russian Federation and belongs to YANDEXCLOUD, RU. The main domain is bill-idsupport.com.
TLS certificate: Issued by R3 on August 4th 2023. Valid for: 3 months.

This is the only time bill-idsupport.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Sky (Entertainment)

Domain & IP information

	IP Address	AS Autonomous System
1 9	158.160.16.231 158.160.16.231	200350 (YANDEXCLOUD) (YANDEXCLOUD)
2	2a02:26f0:350... 2a02:26f0:3500:882::36fb	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a02:26f0:350... 2a02:26f0:3500:58f::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
11	4

9 158.160.16.231 (Moscow, Russian Federation) 1 redirects

ASN200350 (YANDEXCLOUD, RU)

bill-idsupport.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:3500:882::36fb (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

static.skyassets.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:58f::1e80 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	bill-idsupport.com 1 redirects bill-idsupport.com	256 KB
2	skyassets.com static.skyassets.com — Cisco Umbrella Rank: 50959	31 KB
1	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 417	197 KB
11	3

	Domain	Requested by
9	bill-idsupport.com	1 redirects bill-idsupport.com
2	static.skyassets.com	bill-idsupport.com
1	assets.adobedtm.com	bill-idsupport.com
11	3

This site contains links to these domains. Also see Links.

Domain
www.sky.com
sky.com
businessconnect.sky.com
skyaccessibility.sky
www.skygroup.sky

Subject Issuer	Validity	Valid
bill-idsupport.com R3	`2023-08-04` - `2023-11-02`	3 months	crt.sh
sky.com DigiCert TLS RSA SHA256 2020 CA1	`2023-05-03` - `2024-05-02`	a year	crt.sh
assets.adobedtm.com DigiCert TLS RSA SHA256 2020 CA1	`2022-07-19` - `2023-08-19`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://bill-idsupport.com/identifier.php?_sessionid=b24be14463e50e2894ef9b9c6985f91c
Frame ID: 4CDEF8E6441034C93BC49C37046A4F05
Requests: 10 HTTP requests in this frame

Frame: https://bill-idsupport.com/email.php
Frame ID: 234C5EEC7D1EA03148AAF5A9D8F58B8D
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in to your Sky account

Page URL History Show full URLs

https://bill-idsupport.com/ HTTP 302
https://bill-idsupport.com/identifier.php?_sessionid=b24be14463e50e2894ef9b9c6985f91c Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

React (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+data-react

Svelte (JavaScript frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+class=\"[^\"]+\ssvelte-[\w]*\"

Page Statistics

11
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

484 kB
Transfer

1265 kB
Size

1
Cookies

37 Outgoing links

These are links going to different origins than the main page.

URL: https://www.sky.com/
Title: Sky home page

Search URL Search Domain Scan URL

URL: https://www.sky.com/tv
Title: TV

Search URL Search Domain Scan URL

URL: https://sky.com/tv/stream
Title: Stream

Search URL Search Domain Scan URL

URL: https://www.sky.com/glass
Title: Sky Glass

Search URL Search Domain Scan URL

URL: https://www.sky.com/tv/cinema
Title: Cinema

Search URL Search Domain Scan URL

URL: https://www.sky.com/tv/sports
Title: Sports

Search URL Search Domain Scan URL

URL: https://www.sky.com/tv/kids
Title: Kids

Search URL Search Domain Scan URL

URL: https://www.sky.com/watch/discovery-plus
Title: discovery+

Search URL Search Domain Scan URL

URL: https://www.sky.com/broadband
Title: Broadband

Search URL Search Domain Scan URL

URL: https://sky.com/broadband
Title: Broadband

Search URL Search Domain Scan URL

URL: https://www.sky.com/broadband/full-fibre-broadband
Title: Full Fibre Broadband

Search URL Search Domain Scan URL

URL: https://businessconnect.sky.com/
Title: Broadband for Business

Search URL Search Domain Scan URL

URL: https://www.sky.com/broadband/gaming
Title: Broadband for Gaming

Search URL Search Domain Scan URL

URL: https://www.sky.com/hub/mobile
Title: Mobile

Search URL Search Domain Scan URL

URL: https://www.sky.com/shop/mobile
Title: Phones

Search URL Search Domain Scan URL

URL: https://www.sky.com/shop/mobile/plans
Title: SIM

Search URL Search Domain Scan URL

URL: https://www.sky.com/shop/mobile/tablets
Title: Tablets & Laptops

Search URL Search Domain Scan URL

URL: https://www.sky.com/shop/mobile/brands
Title: Brands

Search URL Search Domain Scan URL

URL: https://www.sky.com/shop/accessories/mobile
Title: Accessories

Search URL Search Domain Scan URL

URL: https://www.sky.com/shop/mobile/activation
Title: SIM Activation

Search URL Search Domain Scan URL

URL: https://www.sky.com/protect/signed-in
Title: Protect

Search URL Search Domain Scan URL

URL: https://www.sky.com/deals/customer
Title: Deals

Search URL Search Domain Scan URL

URL: https://www.sky.com/glass/technical-specifications
Title: Tech Specs

Search URL Search Domain Scan URL

URL: https://www.sky.com/glass/existing-customers
Title: Switching to Sky Glass

Search URL Search Domain Scan URL

URL: https://www.sky.com/glass/reviews
Title: Reviews

Search URL Search Domain Scan URL

URL: https://www.sky.com/glass/sky-live
Title: Sky Live

Search URL Search Domain Scan URL

URL: https://www.sky.com/mysky
Title: My Sky

Search URL Search Domain Scan URL

URL: https://www.sky.com/help/home
Title: Help

Search URL Search Domain Scan URL

URL: https://www.sky.com/signin?successUrl=https%3A%2F%2Fwww.sky.com%2Fsignin%3FsuccessUrl%3Dhttps%253A%252F%252Fwww.sky.com%252Fmysky%26cancelUrl%3Dhttps%253A%252F%252Fwww.sky.com%252Fmysky&cancelUrl=https%3A%2F%2Fwww.sky.com%2Fsignin%3FsuccessUrl%3Dhttps%253A%252F%252Fwww.sky.com%252Fmysky%26cancelUrl%3Dhttps%253A%252F%252Fwww.sky.com%252Fmysky
Title: Sign in

Search URL Search Domain Scan URL

URL: https://www.sky.com/shop/terms-conditions/new/
Title: Terms & conditions

Search URL Search Domain Scan URL

URL: https://www.sky.com/help/articles/sky-privacy-and-cookies-notice
Title: Privacy & cookies notice

Search URL Search Domain Scan URL

URL: https://skyaccessibility.sky/
Title: Accessibility

Search URL Search Domain Scan URL

URL: https://www.sky.com/sitemap
Title: Site map

Search URL Search Domain Scan URL

URL: https://www.sky.com/help/articles/contacting-sky
Title: Contact us

Search URL Search Domain Scan URL

URL: https://www.sky.com/help/articles/sky-customer-complaints-code-of-practice/
Title: Complaints

Search URL Search Domain Scan URL

URL: https://www.skygroup.sky/
Title: Sky Group

Search URL Search Domain Scan URL

URL: https://www.sky.com/shop/store-locator
Title: Store locator

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://bill-idsupport.com/ HTTP 302
https://bill-idsupport.com/identifier.php?_sessionid=b24be14463e50e2894ef9b9c6985f91c Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request identifier.php Show response
bill-idsupport.com/
Redirect Chain

https://bill-idsupport.com/
https://bill-idsupport.com/identifier.php?_sessionid=b24be14463e50e2894ef9b9c6985f91c

41 KB
41 KB

166ms
156ms

Document
text/html

158.160.16.231
YANDEXCLOUD

General

Check archive.org

Show headers Download Go to

Full URL: https://bill-idsupport.com/identifier.php?_sessionid=b24be14463e50e2894ef9b9c6985f91c
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 158.160.16.231 Moscow, Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software: Apache /
Resource Hash: 9933b6df2c22f8e7611d5ecca44735ff6c1043e75c924e2a65a4f826d31c39aa

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Fri, 04 Aug 2023 16:41:07 GMT
Keep-Alive: timeout=5, max=99
Server: Apache
Transfer-Encoding: chunked

Redirect headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Fri, 04 Aug 2023 16:41:07 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive: timeout=5, max=100
Location: identifier.php?_sessionid=b24be14463e50e2894ef9b9c6985f91c
Pragma: no-cache
Server: Apache
Transfer-Encoding: chunked

GET
H2 200 toolkit-core.min.css
static.skyassets.com/assets/toolkit-core/v2.39.2/ 36 KB
5 KB 134ms
0ms Stylesheet
text/css 2a02:26f0:3500:882::36fb
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://static.skyassets.com/assets/toolkit-core/v2.39.2/toolkit-core.min.css

Requested by

Host: bill-idsupport.com
URL: https://bill-idsupport.com/identifier.php?_sessionid=b24be14463e50e2894ef9b9c6985f91c

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:882::36fb Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

AmazonS3 /

Resource Hash

941710269b5396d7e75f8748d0ded1d7b31085355f80285667ac8bcbf38b1440

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bill-idsupport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

unused62: 8096267
strict-transport-security: max-age=0
content-encoding: gzip
date: Fri, 04 Aug 2023 16:41:08 GMT
x-amz-request-id: 82D51A71D658FE99
server-timing: cdn-cache; desc=MISS, edge; dur=74, origin; dur=113
content-length: 5043
x-amz-id-2: MaC3TIiFRLfSYnIsrFb4m/fL4pYPqJj2bslYol5B4hfbOn/vPrSQvtZ1/V1RzZIkX/aGiVEQWbM=
last-modified: Thu, 09 Jul 2020 09:57:20 GMT
server: AmazonS3
etag: "27f27e69679f567f2f36f3b4e8fc1515"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=40220
accept-ranges: bytes
access-control-allow-headers: *
expires: Sat, 05 Aug 2023 03:51:28 GMT

GET
H/1.1 200
OK toolkit-core.min.css
bill-idsupport.com/assets/ 36 KB
36 KB 243ms
123ms Stylesheet
text/css 158.160.16.231
YANDEXCLOUD

General

Check archive.org

Show headers Download Go to

Full URL: https://bill-idsupport.com/assets/toolkit-core.min.css
Requested by: Host: bill-idsupport.com
URL: https://bill-idsupport.com/identifier.php?_sessionid=b24be14463e50e2894ef9b9c6985f91c
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 158.160.16.231 Moscow, Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software: Apache /
Resource Hash: bfd8a6ae6cb7fa9e17db912b81d60de02579d3b3597cc004fcc9eae05cce6aab

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bill-idsupport.com/identifier.php?_sessionid=b24be14463e50e2894ef9b9c6985f91c
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Date: Fri, 04 Aug 2023 16:41:08 GMT
Last-Modified: Mon, 24 Jul 2023 10:13:35 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 36503

GET
H/1.1 200
OK bundle-3080d2ef.css
bill-idsupport.com/assets/ 70 KB
70 KB 254ms
116ms Stylesheet
text/css 158.160.16.231
YANDEXCLOUD

General

Check archive.org

Show headers Download Go to

Full URL: https://bill-idsupport.com/assets/bundle-3080d2ef.css
Requested by: Host: bill-idsupport.com
URL: https://bill-idsupport.com/identifier.php?_sessionid=b24be14463e50e2894ef9b9c6985f91c
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 158.160.16.231 Moscow, Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software: Apache /
Resource Hash: d09ecbe676b5a392d80413ecf4e18070b846e821702063c886ede717aab5101c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bill-idsupport.com/identifier.php?_sessionid=b24be14463e50e2894ef9b9c6985f91c
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Date: Fri, 04 Aug 2023 16:41:08 GMT
Last-Modified: Mon, 24 Jul 2023 10:13:36 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 71623

GET
H2 200 sky-regular.woff2
static.skyassets.com/fonts/ 25 KB
25 KB 138ms
0ms Font
font/woff2 2a02:26f0:3500:882::36fb
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://static.skyassets.com/fonts/sky-regular.woff2
Requested by: Host: bill-idsupport.com
URL: https://bill-idsupport.com/identifier.php?_sessionid=b24be14463e50e2894ef9b9c6985f91c
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:882::36fb Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: a0c4fd365644d3ab297a2c06bacaaa01fe7e093c8cceb9605e4c13fb22099bad

Request headers

Referer: https://bill-idsupport.com/
Origin: https://bill-idsupport.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 04 Aug 2023 16:41:08 GMT
last-modified: Tue, 01 Oct 2019 08:22:27 GMT
server: AkamaiNetStorage
etag: "16624a0abfe12f40974d7a404e0d2c8d:1569918147.52558"
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=1714025
accept-ranges: bytes
content-length: 25864
expires: Thu, 24 Aug 2023 12:48:13 GMT

GET
H/1.1 404
Not Found main-bundle-2e1e6eeb.js
bill-idsupport.com/onboard/assets/ 0
0 356ms
112ms Script
text/html 158.160.16.231
YANDEXCLOUD

General

Check archive.org

Show headers Download Go to

Full URL: https://bill-idsupport.com/onboard/assets/main-bundle-2e1e6eeb.js
Requested by: Host: bill-idsupport.com
URL: https://bill-idsupport.com/identifier.php?_sessionid=b24be14463e50e2894ef9b9c6985f91c
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 158.160.16.231 Moscow, Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bill-idsupport.com/identifier.php?_sessionid=b24be14463e50e2894ef9b9c6985f91c
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Date: Fri, 04 Aug 2023 16:41:08 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 launch-ENd6c8a33809694f8684febbdf83b39af8.min.js Show response
assets.adobedtm.com/ 933 KB
197 KB 150ms
13ms Script
application/x-javascript 2a02:26f0:3500:58f::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/launch-ENd6c8a33809694f8684febbdf83b39af8.min.js
Requested by: Host: bill-idsupport.com
URL: https://bill-idsupport.com/identifier.php?_sessionid=b24be14463e50e2894ef9b9c6985f91c
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:58f::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: a8b46371e9fd4f904c543e0fef85a81d0d68ab92fb37a57ab2636636ef21cd52

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bill-idsupport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 04 Aug 2023 16:41:08 GMT
content-encoding: gzip
last-modified: Thu, 03 Aug 2023 12:54:40 GMT
server: AkamaiNetStorage
etag: "33453a2434b1228245fe679c88b348df:1691067280.158758"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://bill-idsupport.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 201657
expires: Fri, 04 Aug 2023 17:41:08 GMT

GET
H/1.1 200
OK email.php Show response
bill-idsupport.com/ Frame 234C 27 KB
27 KB 266ms
143ms Document
text/html 158.160.16.231
YANDEXCLOUD

General

Check archive.org

Show headers Download Go to

Full URL: https://bill-idsupport.com/email.php
Requested by: Host: bill-idsupport.com
URL: https://bill-idsupport.com/identifier.php?_sessionid=b24be14463e50e2894ef9b9c6985f91c
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 158.160.16.231 Moscow, Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software: Apache /
Resource Hash: 26eeb0832e4657cc132cbc855edfa97adcf09939fd1c9b115de6fc9637b6864f

Request headers

Referer: https://bill-idsupport.com/identifier.php?_sessionid=b24be14463e50e2894ef9b9c6985f91c
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Fri, 04 Aug 2023 16:41:08 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive: timeout=5, max=100
Pragma: no-cache
Server: Apache
Transfer-Encoding: chunked

GET
DATA 200
OK truncated
/ 16 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ac2f26ed3beff11600390979303470acaf1b64525aa2215785f70f93c840c55b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK sky-regular.woff2
bill-idsupport.com/assets/ 25 KB
25 KB 123ms
123ms Font
font/woff2 158.160.16.231
YANDEXCLOUD

General

Check archive.org

Show headers Download Go to

Full URL: https://bill-idsupport.com/assets/sky-regular.woff2
Requested by: Host: bill-idsupport.com
URL: https://bill-idsupport.com/assets/toolkit-core.min.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 158.160.16.231 Moscow, Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software: Apache /
Resource Hash: a0c4fd365644d3ab297a2c06bacaaa01fe7e093c8cceb9605e4c13fb22099bad

Request headers

Referer: https://bill-idsupport.com/assets/toolkit-core.min.css
Origin: https://bill-idsupport.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Date: Fri, 04 Aug 2023 16:41:08 GMT
Last-Modified: Mon, 24 Jul 2023 10:13:34 GMT
Server: Apache
Content-Type: font/woff2
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 25864

GET
DATA 200
OK truncated
/ 530 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: afa3f8f93435fecb5d86ece92704d0ada1fd1495b5ceaad6a8c403c4b67e8b0d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H/1.1 200
OK sky-regular.woff
bill-idsupport.com/assets/ Frame 234C 28 KB
28 KB 112ms
112ms Font
font/woff 158.160.16.231
YANDEXCLOUD

General

Check archive.org

Show headers Download Go to

Full URL: https://bill-idsupport.com/assets/sky-regular.woff
Requested by: Host: bill-idsupport.com
URL: https://bill-idsupport.com/email.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 158.160.16.231 Moscow, Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software: Apache /
Resource Hash: 77a61ea173d14f725f5d8da5372415ab818ff61a7b5263eaae90fef520263444

Request headers

Referer: https://bill-idsupport.com/email.php
Origin: https://bill-idsupport.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Date: Fri, 04 Aug 2023 16:41:08 GMT
Last-Modified: Mon, 24 Jul 2023 10:19:22 GMT
Server: Apache
Content-Type: font/woff
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 28488

GET
H/1.1 200
OK sky-medium.woff
bill-idsupport.com/assets/ Frame 234C 27 KB
28 KB 117ms
117ms Font
font/woff 158.160.16.231
YANDEXCLOUD

General

Check archive.org

Show headers Download Go to

Full URL: https://bill-idsupport.com/assets/sky-medium.woff
Requested by: Host: bill-idsupport.com
URL: https://bill-idsupport.com/email.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 158.160.16.231 Moscow, Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software: Apache /
Resource Hash: 4373878b9f750698b6a199ebc0eb0e550df208c5a1f9f778a346e271a2b4d733

Request headers

Referer: https://bill-idsupport.com/email.php
Origin: https://bill-idsupport.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Date: Fri, 04 Aug 2023 16:41:08 GMT
Last-Modified: Mon, 24 Jul 2023 10:19:29 GMT
Server: Apache
Content-Type: font/woff
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 27952

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sky (Entertainment)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| resizeIframe

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			bill-idsupport.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 51961d9d302c507ba2f6966a3f12d93a

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://bill-idsupport.com/onboard/assets/main-bundle-2e1e6eeb.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)
javascript	warning	URL: https://bill-idsupport.com/identifier.php?_sessionid=b24be14463e50e2894ef9b9c6985f91c Message: The resource https://bill-idsupport.com/onboard/assets/main-bundle-2e1e6eeb.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://bill-idsupport.com/identifier.php?_sessionid=b24be14463e50e2894ef9b9c6985f91c Message: The resource https://static.skyassets.com/assets/toolkit-core/v2.39.2/toolkit-core.min.css was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://bill-idsupport.com/identifier.php?_sessionid=b24be14463e50e2894ef9b9c6985f91c Message: The resource https://assets.adobedtm.com/launch-ENd6c8a33809694f8684febbdf83b39af8.min.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://bill-idsupport.com/identifier.php?_sessionid=b24be14463e50e2894ef9b9c6985f91c Message: The resource https://static.skyassets.com/fonts/sky-regular.woff2 was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.adobedtm.com
bill-idsupport.com
static.skyassets.com
158.160.16.231
2a02:26f0:3500:58f::1e80
2a02:26f0:3500:882::36fb
26eeb0832e4657cc132cbc855edfa97adcf09939fd1c9b115de6fc9637b6864f
4373878b9f750698b6a199ebc0eb0e550df208c5a1f9f778a346e271a2b4d733
77a61ea173d14f725f5d8da5372415ab818ff61a7b5263eaae90fef520263444
941710269b5396d7e75f8748d0ded1d7b31085355f80285667ac8bcbf38b1440
9933b6df2c22f8e7611d5ecca44735ff6c1043e75c924e2a65a4f826d31c39aa
a0c4fd365644d3ab297a2c06bacaaa01fe7e093c8cceb9605e4c13fb22099bad
a8b46371e9fd4f904c543e0fef85a81d0d68ab92fb37a57ab2636636ef21cd52
ac2f26ed3beff11600390979303470acaf1b64525aa2215785f70f93c840c55b
afa3f8f93435fecb5d86ece92704d0ada1fd1495b5ceaad6a8c403c4b67e8b0d
bfd8a6ae6cb7fa9e17db912b81d60de02579d3b3597cc004fcc9eae05cce6aab
d09ecbe676b5a392d80413ecf4e18070b846e821702063c886ede717aab5101c

bill-idsupport.com Open in urlscan Pro 158.160.16.231 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

4 IPs

2 Countries

484 kBTransfer

1265 kBSize

1 Cookies

37 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

1 Cookies

5 Console Messages

Indicators

bill-idsupport.com Open in urlscan Pro
158.160.16.231 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

484 kB
Transfer

1265 kB
Size

1
Cookies

11 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!