billing-update2.com
Open in
urlscan Pro
194.5.212.83
Malicious Activity!
Public Scan
Submitted URL: http://billing-update2.com/
Effective URL: https://billing-update2.com/app/login.php?MTczMTA3MjMxOWVjYzFkYTFkODY3YzM3N2I5NDQzM2M0NzA0NThiYTZmZDZiMWRiNWQzOTIwYWIxNWY0M2...
Submission: On November 08 via api from DE — Scanned from CA
Effective URL: https://billing-update2.com/app/login.php?MTczMTA3MjMxOWVjYzFkYTFkODY3YzM3N2I5NDQzM2M0NzA0NThiYTZmZDZiMWRiNWQzOTIwYWIxNWY0M2...
Submission: On November 08 via api from DE — Scanned from CA
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 9 HTTP transactions.
The main IP is 194.5.212.83, located in
Frankfurt am Main, Germany and
belongs to M247, RO.
The main domain is billing-update2.com.
TLS certificate: Issued by R10 on November 7th 2024. Valid for: 3 months.
This is the only time billing-update2.com was scanned on urlscan.io!
TLS certificate: Issued by R10 on November 7th 2024. Valid for: 3 months.
This is the only time billing-update2.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Freedom Mobile (Telecommunication)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 9 | 194.5.212.83 194.5.212.83 | 9009 (M247) (M247) | |
| 1 | 108.156.91.116 108.156.91.116 | 16509 (AMAZON-02) (AMAZON-02) | |
| 9 | 2 |
1
108.156.91.116
(United States)
ASN16509 (AMAZON-02, US)
PTR: server-108-156-91-116.ord56.r.cloudfront.net
ASN16509 (AMAZON-02, US)
PTR: server-108-156-91-116.ord56.r.cloudfront.net
| login.freedommobile.ca |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 9 |
billing-update2.com
1 redirects
billing-update2.com |
130 KB |
| 1 |
freedommobile.ca
login.freedommobile.ca |
1 KB |
| 9 | 2 |
| Domain | Requested by | |
|---|---|---|
| 9 | billing-update2.com |
1 redirects
billing-update2.com
|
| 1 | login.freedommobile.ca | |
| 9 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| shop.freedommobile.ca |
| login.freedommobile.ca |
| myaccount.freedommobile.ca |
| frdm.mobi |
| www.messenger.com |
| twitter.com |
| locations.freedommobile.ca |
| www.facebook.com |
| www.instagram.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| freedom.mobile5g-info.com R10 |
2024-11-07 - 2025-02-05 |
3 months | crt.sh |
| www.freedommobile.ca DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2024-03-14 - 2025-03-13 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://billing-update2.com/app/login.php?MTczMTA3MjMxOWVjYzFkYTFkODY3YzM3N2I5NDQzM2M0NzA0NThiYTZmZDZiMWRiNWQzOTIwYWIxNWY0M2MxNTg0MjAyZTVkZDhjNTkxMTY4Yg==
Frame ID: 0A404BFB37AD5B247878064BA8746CA2
Requests: 9 HTTP requests in this frame
Screenshot
Page Title
Login PagePage URL History Show full URLs
-
http://billing-update2.com/
HTTP 307
https://billing-update2.com/ HTTP 302
https://billing-update2.com/app/login.php?MTczMTA3MjMxOWVjYzFkYTFkODY3YzM3N2I5NDQzM2M0NzA0NThiYTZmZDZiMW... Page URL
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- \.php(?:$|\?)
Page Statistics
17 Outgoing links
These are links going to different origins than the main page.
URL: https://shop.freedommobile.ca/en-CA/
Title: Devices
Title: Devices
Search URL Search Domain Scan URL
URL: https://shop.freedommobile.ca/en-CA/plans
Title: Plans
Title: Plans
Search URL Search Domain Scan URL
URL: https://shop.freedommobile.ca/en-CA/prepaid-plans
Title: Prepaid
Title: Prepaid
Search URL Search Domain Scan URL
URL: https://login.freedommobile.ca/
Title: Login
Title: Login
Search URL Search Domain Scan URL
URL: https://myaccount.freedommobile.ca/express-payments
Title: Express Payment
Title: Express Payment
Search URL Search Domain Scan URL
URL: https://myaccount.freedommobile.ca/
Title: My Account
Title: My Account
Search URL Search Domain Scan URL
URL: https://shop.freedommobile.ca/en-CA/sim-activation
Title: SIM Activation
Title: SIM Activation
Search URL Search Domain Scan URL
URL: https://frdm.mobi/AppleBusinessChat
Title: Apple iMessage
Title: Apple iMessage
Search URL Search Domain Scan URL
URL: https://frdm.mobi/WhatsApp
Title: WhatsApp
Title: WhatsApp
Search URL Search Domain Scan URL
URL: https://www.messenger.com/t/frdmmobile
Title: Facebook Messenger
Title: Facebook Messenger
Search URL Search Domain Scan URL
URL: https://twitter.com/freedomsupport
Title: Twitter
Title: Twitter
Search URL Search Domain Scan URL
URL: https://locations.freedommobile.ca/results?address=Toronto,%20ON,%20Canada
Title: Find a Store
Title: Find a Store
Search URL Search Domain Scan URL
URL: https://login.freedommobile.ca/forgot-pin
Title: Forgot or need a new PIN?
Title: Forgot or need a new PIN?
Search URL Search Domain Scan URL
URL: https://shop.freedommobile.ca/en-CA/devices
Title: Shop our latest Devices
Title: Shop our latest Devices
Search URL Search Domain Scan URL
URL: https://www.facebook.com/frdmmobile
Search URL Search Domain Scan URL
URL: https://www.instagram.com/frdmmobile
Search URL Search Domain Scan URL
URL: https://twitter.com/FreedomMobile
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://billing-update2.com/
HTTP 307
https://billing-update2.com/ HTTP 302
https://billing-update2.com/app/login.php?MTczMTA3MjMxOWVjYzFkYTFkODY3YzM3N2I5NDQzM2M0NzA0NThiYTZmZDZiMWRiNWQzOTIwYWIxNWY0M2MxNTg0MjAyZTVkZDhjNTkxMTY4Yg== Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
login.php
billing-update2.com/app/ Redirect Chain
|
243 KB 114 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
gotham-fonts.css
billing-update2.com/app/files/ |
4 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
css
billing-update2.com/app/files/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
newlogo.svg
billing-update2.com/app/files/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
icon_find-a-store-white.svg
billing-update2.com/app/files/ |
932 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
icon_facebook.svg
billing-update2.com/app/files/ |
3 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
icon_instagram.svg
billing-update2.com/app/files/ |
2 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
icon_twitter.svg
billing-update2.com/app/files/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
favicon.png
login.freedommobile.ca/ |
974 B 1 KB |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Freedom Mobile (Telecommunication)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| originalTexts function| changeText1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| billing-update2.com/ | Name: PHPSESSID Value: qfa1v6gtutpvk25bc50hedu1aj |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
billing-update2.com
login.freedommobile.ca
108.156.91.116
194.5.212.83
1749b047493a89cb18b2331f4e07eabda3aca2b2d8ccd23726929f55199292e7
2b3a9e907f250fb44e9ac5a18ba0b4b876068f38a8ab54752a4a3282267d5c44
6c465a20f20d5eaa7ef07345b457edf1e2a65ab48aa6b2049a677697201e0d9c
6d05c3a7c2e0da6d68f666e5d2ef46bbbe7641d426d44173f3c6ae4ca00ec8c2
784fa492c1cf898aced99778606dbb162e742f263068924ed71e3ab182fffbf7
9c24ab421977ba24f34f11e25939158876f395dbf120cbca9e2edca8086878ff
ae344d05083e0d0b864ac66a7885dd8598e672ea8f68e0f494c1a05fb4f51436
ec21e08051341ffcd35aa8708dda481e703c3d089750a2f1330752c81ce4763e