p3te5emeog.execute-api.us-east-1.amazonaws.com Open in urlscan Pro
3.91.115.240  Malicious Activity! Public Scan

Submitted URL: https://0ju4hz7x94.execute-api.us-east-1.amazonaws.com/default/BT-new-redirect
Effective URL: https://p3te5emeog.execute-api.us-east-1.amazonaws.com/default/BTpage
Submission: On December 11 via api from US — Scanned from US

Summary

This website contacted 3 IPs in 1 countries across 4 domains to perform 5 HTTP transactions. The main IP is 3.91.115.240, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is p3te5emeog.execute-api.us-east-1.amazonaws.com.
TLS certificate: Issued by Amazon RSA 2048 M02 on July 25th 2023. Valid for: a year.
This is the only time p3te5emeog.execute-api.us-east-1.amazonaws.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BT (Telecommunication)

Domain & IP information

IP Address AS Autonomous System
1 1 3.234.48.245 14618 (AMAZON-AES)
1 3.91.115.240 14618 (AMAZON-AES)
3 69.164.47.16 22822 (LLNW)
1 146.75.37.230 54113 (FASTLY)
5 3
Apex Domain
Subdomains
Transfer
2 bt.co.uk
img01.bt.co.uk — Cisco Umbrella Rank: 152416
2 KB
2 amazonaws.com
0ju4hz7x94.execute-api.us-east-1.amazonaws.com
p3te5emeog.execute-api.us-east-1.amazonaws.com
27 KB
1 medallia.eu
resources.digital-cloud-uk.medallia.eu — Cisco Umbrella Rank: 29957
1 bt.com
home.bt.com — Cisco Umbrella Rank: 127405
22 KB
5 4
Domain Requested by
2 img01.bt.co.uk p3te5emeog.execute-api.us-east-1.amazonaws.com
1 resources.digital-cloud-uk.medallia.eu p3te5emeog.execute-api.us-east-1.amazonaws.com
1 home.bt.com p3te5emeog.execute-api.us-east-1.amazonaws.com
1 p3te5emeog.execute-api.us-east-1.amazonaws.com
1 0ju4hz7x94.execute-api.us-east-1.amazonaws.com 1 redirects
5 5

This site contains links to these domains. Also see Links.

Domain
home.bt.com
www.bt.com
business.bt.com
www.globalservices.bt.com
signin1.bt.com
my.bt.com
Subject Issuer Validity Valid
*.execute-api.us-east-1.amazonaws.com
Amazon RSA 2048 M02
2023-07-25 -
2024-08-21
a year crt.sh
www.bt.com
GeoTrust EV RSA CA G2
2023-09-04 -
2024-09-24
a year crt.sh
resources.digital-cloud-uk.medallia.eu
R3
2023-11-12 -
2024-02-10
3 months crt.sh

This page contains 1 frames:

Primary Page: https://p3te5emeog.execute-api.us-east-1.amazonaws.com/default/BTpage
Frame ID: 7717DC0890166C81F71B485B5E05484A
Requests: 5 HTTP requests in this frame

Screenshot

Page Title

BT

Page URL History Show full URLs

  1. https://0ju4hz7x94.execute-api.us-east-1.amazonaws.com/default/BT-new-redirect HTTP 301
    https://p3te5emeog.execute-api.us-east-1.amazonaws.com/default/BTpage Page URL

Page Statistics

5
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

5
Subdomains

3
IPs

1
Countries

50 kB
Transfer

50 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://0ju4hz7x94.execute-api.us-east-1.amazonaws.com/default/BT-new-redirect HTTP 301
    https://p3te5emeog.execute-api.us-east-1.amazonaws.com/default/BTpage Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request BTpage
p3te5emeog.execute-api.us-east-1.amazonaws.com/default/
Redirect Chain
  • https://0ju4hz7x94.execute-api.us-east-1.amazonaws.com/default/BT-new-redirect
  • https://p3te5emeog.execute-api.us-east-1.amazonaws.com/default/BTpage
27 KB
27 KB
Document
General
Full URL
https://p3te5emeog.execute-api.us-east-1.amazonaws.com/default/BTpage
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.91.115.240 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-91-115-240.compute-1.amazonaws.com
Software
/
Resource Hash
9821773c7bdc978792842ae7276d83481d3ee95d9d003cf4963d112153270e81

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

apigw-requestid
Px6kshS5oAMEPNg=
content-length
27145
content-type
text/html
date
Mon, 11 Dec 2023 13:13:14 GMT

Redirect headers

apigw-requestid
Px6kqhR2IAMEaPg=
content-length
0
date
Mon, 11 Dec 2023 13:13:14 GMT
location
https://p3te5emeog.execute-api.us-east-1.amazonaws.com/default/BTpage
logo-2018.svg
img01.bt.co.uk/s/assets/210322/images/logo/
1 KB
989 B
Image
General
Full URL
https://img01.bt.co.uk/s/assets/210322/images/logo/logo-2018.svg
Requested by
Host: p3te5emeog.execute-api.us-east-1.amazonaws.com
URL: https://p3te5emeog.execute-api.us-east-1.amazonaws.com/default/BTpage
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
69.164.47.16 New York, United States, ASN22822 (LLNW, US),
Reverse DNS
https-69-164-47-16.jfk.llnw.net
Software
/
Resource Hash
07e9d4d6a617d90407a0041a950912ba8f85bcb61be41deec67fc95aa16062a1
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://p3te5emeog.execute-api.us-east-1.amazonaws.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date
Mon, 11 Dec 2023 13:13:15 GMT
content-security-policy
frame-ancestors 'self'
content-encoding
gzip
age
18992
x-btsite
1
content-length
628
x-xss-protection
1; mode=block
x-ua-compatible
IE=Edge
last-modified
Wed, 20 Sep 2023 14:52:43 GMT
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
max-age=86400
accept-ranges
bytes
x-llid
4b3c08cc8c727917006af291d5190617
expires
Tue, 12 Dec 2023 07:56:43 GMT
we-have-redifined-reliabilty-136446268730102601-231129182408.jpg
home.bt.com/images/
22 KB
22 KB
Image
General
Full URL
https://home.bt.com/images/we-have-redifined-reliabilty-136446268730102601-231129182408.jpg
Requested by
Host: p3te5emeog.execute-api.us-east-1.amazonaws.com
URL: https://p3te5emeog.execute-api.us-east-1.amazonaws.com/default/BTpage
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
69.164.47.16 New York, United States, ASN22822 (LLNW, US),
Reverse DNS
https-69-164-47-16.jfk.llnw.net
Software
/
Resource Hash
e8820cd099f0ba975bb3bcdb7d653c278fa2aaea80a98c8a21c8ca1e9a40f399
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://p3te5emeog.execute-api.us-east-1.amazonaws.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

expires
Mon, 11 Dec 2023 19:01:15 GMT
date
Mon, 11 Dec 2023 13:13:14 GMT
content-security-policy
frame-ancestors 'self'
mdt-type
abinary; charset=UTF-8
last-modified
Sun, 10 Dec 2023 13:48:10 GMT
age
65519
x-frame-options
SAMEORIGIN
content-type
image/jpeg
x-btsite
1
cache-control
max-age=86400
content-length
22025
x-xss-protection
1; mode=block
x-llid
7275ff87cf61efee440fd31f714f7521
x-ua-compatible
IE=Edge
logo-footer2018.svg
img01.bt.co.uk/s/assets/210322/images/logo/
1 KB
990 B
Image
General
Full URL
https://img01.bt.co.uk/s/assets/210322/images/logo/logo-footer2018.svg
Requested by
Host: p3te5emeog.execute-api.us-east-1.amazonaws.com
URL: https://p3te5emeog.execute-api.us-east-1.amazonaws.com/default/BTpage
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
69.164.47.16 New York, United States, ASN22822 (LLNW, US),
Reverse DNS
https-69-164-47-16.jfk.llnw.net
Software
/
Resource Hash
07e9d4d6a617d90407a0041a950912ba8f85bcb61be41deec67fc95aa16062a1
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://p3te5emeog.execute-api.us-east-1.amazonaws.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date
Mon, 11 Dec 2023 13:13:15 GMT
content-security-policy
frame-ancestors 'self'
content-encoding
gzip
age
54015
x-btsite
1
content-length
628
x-xss-protection
1; mode=block
x-ua-compatible
IE=Edge
last-modified
Wed, 20 Sep 2023 14:52:43 GMT
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
max-age=86400
accept-ranges
bytes
x-llid
2abfd936b9c847cda99220e5cd9d3d3b
expires
Mon, 11 Dec 2023 22:13:00 GMT
1534441432041_-Desktop-35X112px.png
resources.digital-cloud-uk.medallia.eu/wdcuk/244/resources/image/
0
0
Image
General
Full URL
https://resources.digital-cloud-uk.medallia.eu/wdcuk/244/resources/image/1534441432041_-Desktop-35X112px.png
Requested by
Host: p3te5emeog.execute-api.us-east-1.amazonaws.com
URL: https://p3te5emeog.execute-api.us-east-1.amazonaws.com/default/BTpage
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
146.75.37.230 Reston, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-US,en;q=0.9
Referer
https://p3te5emeog.execute-api.us-east-1.amazonaws.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BT (Telecommunication)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| documentPictureInPicture

0 Cookies

1 Console Messages

Source Level URL
Text
network error URL: https://resources.digital-cloud-uk.medallia.eu/wdcuk/244/resources/image/1534441432041_-Desktop-35X112px.png
Message:
Failed to load resource: the server responded with a status of 403 ()