telus-update-billing-payment-ssl-443-cert-info-secure.mak164.top
Open in
urlscan Pro
2606:4700:30::681b:bc4e
Malicious Activity!
Public Scan
Effective URL: https://telus-update-billing-payment-ssl-443-cert-info-secure.mak164.top/SiteIdentity/Login.php?as/authorization.oauth2?client_id=uni_portal&response_type=code&scope=pro...
Submission: On December 24 via manual from CA
Summary
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on December 13th 2019. Valid for: 10 months.
This is the only time telus-update-billing-payment-ssl-443-cert-info-secure.mak164.top was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Telus (Telecommunication)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 54.157.210.181 54.157.210.181 | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
1 19 | 2606:4700:30:... 2606:4700:30::681b:bc4e | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
18 | 1 |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-157-210-181.compute-1.amazonaws.com
wiseware.net |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
telus-update-billing-payment-ssl-443-cert-info-secure.mak164.top |
Apex Domain Subdomains |
Transfer | |
---|---|---|
19 |
mak164.top
1 redirects
telus-update-billing-payment-ssl-443-cert-info-secure.mak164.top |
252 KB |
1 |
wiseware.net
1 redirects
wiseware.net |
313 B |
18 | 2 |
Domain | Requested by | |
---|---|---|
19 | telus-update-billing-payment-ssl-443-cert-info-secure.mak164.top |
1 redirects
telus-update-billing-payment-ssl-443-cert-info-secure.mak164.top
|
1 | wiseware.net | 1 redirects |
18 | 2 |
This site contains links to these domains. Also see Links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com CloudFlare Inc ECC CA-2 |
2019-12-13 - 2020-10-09 |
10 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://telus-update-billing-payment-ssl-443-cert-info-secure.mak164.top/SiteIdentity/Login.php?as/authorization.oauth2?client_id=uni_portal&response_type=code&scope=profileinfohighdetail%20customerinfo%20internetservicemanagement%20securitymgmt%20paymentmanagement%20invoiceinfo%20devicemanagement%20phonenumbermgmt%20accountinfo%20accountmanagement%20loyaltyandrewards%20priceplaninfo%20accountactivity%20paymentprocessing%20wifimanagement%20PartnerProfile%20profilemanagement%20usagepreferencemanagement%20usagemeter%20wlspaymentmgmt%20homephonemanagement%20usagemanagement%20usagedetails%20usagenotificationacceptancehistory%20usageblockmanagement%20homesecuritymanagement%20onetimepasscode%20serviceeligibility%20tvsusbscriptioninfo%20appointmentmanagement%20wirelineprotectionsubscriptionservice%20servicemanagement%20hellocustomer%20invoicedocuments%20billpreferencemanagement&redirect_uri=https://api.digital.telus.com/oauth2/callback
Frame ID: 94D8279EB8ADD8D7637237433BC63E21
Requests: 18 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://wiseware.net/wp-content/uploads/2019/12/sslx.php
HTTP 302
https://telus-update-billing-payment-ssl-443-cert-info-secure.mak164.top/SiteIdentity/index.php HTTP 302
https://telus-update-billing-payment-ssl-443-cert-info-secure.mak164.top/SiteIdentity/Login.php?secure=I1Lcdn5zPbGnUbqGEh0uR0rmVO1mGRokBkHgNUMPLlsXPQ... Page URL
- https://telus-update-billing-payment-ssl-443-cert-info-secure.mak164.top/SiteIdentity/Login.php?as/authorization.oauth2?client_id=uni_portal&response... Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- url /\.php(?:$|\?)/i
React (JavaScript Frameworks) Expand
Detected patterns
- html /<[^>]+data-react/i
CloudFlare (CDN) Expand
Detected patterns
- headers server /^cloudflare$/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery[.-]([\d.]*\d)[^\/]*\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
64 Outgoing links
These are links going to different origins than the main page.
Title: TELUS Personal
Search URL Search Domain Scan URL
Title: TELUS Business
Search URL Search Domain Scan URL
Title: TELUS Health
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: Mobility
Search URL Search Domain Scan URL
Title: Phones
Search URL Search Domain Scan URL
Title: Plans
Search URL Search Domain Scan URL
Title: TELUS Drive+
Search URL Search Domain Scan URL
Title: SIM Cards
Search URL Search Domain Scan URL
Title: Tablets
Search URL Search Domain Scan URL
Title: Wireless Home Phone
Search URL Search Domain Scan URL
Title: Prepaid
Search URL Search Domain Scan URL
Title: Add-ons & Apps
Search URL Search Domain Scan URL
Title: Network & Coverage
Search URL Search Domain Scan URL
Title: Travel
Search URL Search Domain Scan URL
Title: Optik TV
Search URL Search Domain Scan URL
Title: Combos
Search URL Search Domain Scan URL
Title: Channels
Search URL Search Domain Scan URL
Title: Hardware
Search URL Search Domain Scan URL
Title: Apps
Search URL Search Domain Scan URL
Title: On Demand
Search URL Search Domain Scan URL
Title: 4K
Search URL Search Domain Scan URL
Title: 4K HDR
Search URL Search Domain Scan URL
Title: Pik TV
Search URL Search Domain Scan URL
Title: Channels
Search URL Search Domain Scan URL
Title: Media Box
Search URL Search Domain Scan URL
Title: Satellite TV
Search URL Search Domain Scan URL
Title: PureFibre
Search URL Search Domain Scan URL
Title: PureFibre Plans
Search URL Search Domain Scan URL
Title: Communities
Search URL Search Domain Scan URL
Title: Internet
Search URL Search Domain Scan URL
Title: Mobile Internet
Search URL Search Domain Scan URL
Title: Home Phone
Search URL Search Domain Scan URL
Title: Long Distance Plans
Search URL Search Domain Scan URL
Title: Home Security & Safety
Search URL Search Domain Scan URL
Title: Learn more
Search URL Search Domain Scan URL
Title: Learn more
Search URL Search Domain Scan URL
Title: Get it now
Search URL Search Domain Scan URL
Title: My TELUS
Search URL Search Domain Scan URL
Title: Support
Search URL Search Domain Scan URL
Title: Email/Username
Search URL Search Domain Scan URL
Title: Password
Search URL Search Domain Scan URL
Title: Create a My TELUS account
Search URL Search Domain Scan URL
Title: About us
Search URL Search Domain Scan URL
Title: Contact us
Search URL Search Domain Scan URL
Title: Find a store
Search URL Search Domain Scan URL
Title: Support
Search URL Search Domain Scan URL
Title: Accessibility
Search URL Search Domain Scan URL
Title: Careers
Search URL Search Domain Scan URL
Title: TELUS Digital
Search URL Search Domain Scan URL
Title: Neighbourhood
Search URL Search Domain Scan URL
Title: We Give Where We Live
Search URL Search Domain Scan URL
Title: Our story
Search URL Search Domain Scan URL
Title: TELUS Webmail
Search URL Search Domain Scan URL
Title: TELUS Wise
Search URL Search Domain Scan URL
Title: TELUS International
Search URL Search Domain Scan URL
Title: TELUS Partner Solutions
Search URL Search Domain Scan URL
Title: TELUS Blog
Search URL Search Domain Scan URL
Title: CRTC Wireless Code
Search URL Search Domain Scan URL
Title: Privacy / Cookies
Search URL Search Domain Scan URL
Title: Security
Search URL Search Domain Scan URL
Title: Service Terms
Search URL Search Domain Scan URL
Title: User Terms
Search URL Search Domain Scan URL
Title: Policies
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://wiseware.net/wp-content/uploads/2019/12/sslx.php
HTTP 302
https://telus-update-billing-payment-ssl-443-cert-info-secure.mak164.top/SiteIdentity/index.php HTTP 302
https://telus-update-billing-payment-ssl-443-cert-info-secure.mak164.top/SiteIdentity/Login.php?secure=I1Lcdn5zPbGnUbqGEh0uR0rmVO1mGRokBkHgNUMPLlsXPQfLwjim6jZPj44um0OGbt9sAiiDZALJz8sr&sid=hTENphPG3E3lTjM04QCihp2odOmua6iXTJwvx3bDdEPgDV6RtYItOWC8xwAvZMx0SHJmT73n9MtFAgqb Page URL
- https://telus-update-billing-payment-ssl-443-cert-info-secure.mak164.top/SiteIdentity/Login.php?as/authorization.oauth2?client_id=uni_portal&response_type=code&scope=profileinfohighdetail%20customerinfo%20internetservicemanagement%20securitymgmt%20paymentmanagement%20invoiceinfo%20devicemanagement%20phonenumbermgmt%20accountinfo%20accountmanagement%20loyaltyandrewards%20priceplaninfo%20accountactivity%20paymentprocessing%20wifimanagement%20PartnerProfile%20profilemanagement%20usagepreferencemanagement%20usagemeter%20wlspaymentmgmt%20homephonemanagement%20usagemanagement%20usagedetails%20usagenotificationacceptancehistory%20usageblockmanagement%20homesecuritymanagement%20onetimepasscode%20serviceeligibility%20tvsusbscriptioninfo%20appointmentmanagement%20wirelineprotectionsubscriptionservice%20servicemanagement%20hellocustomer%20invoicedocuments%20billpreferencemanagement&redirect_uri=https://api.digital.telus.com/oauth2/callback Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://wiseware.net/wp-content/uploads/2019/12/sslx.php HTTP 302
- https://telus-update-billing-payment-ssl-443-cert-info-secure.mak164.top/SiteIdentity/index.php HTTP 302
- https://telus-update-billing-payment-ssl-443-cert-info-secure.mak164.top/SiteIdentity/Login.php?secure=I1Lcdn5zPbGnUbqGEh0uR0rmVO1mGRokBkHgNUMPLlsXPQfLwjim6jZPj44um0OGbt9sAiiDZALJz8sr&sid=hTENphPG3E3lTjM04QCihp2odOmua6iXTJwvx3bDdEPgDV6RtYItOWC8xwAvZMx0SHJmT73n9MtFAgqb
18 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Login.php
telus-update-billing-payment-ssl-443-cert-info-secure.mak164.top/SiteIdentity/ Redirect Chain
|
179 KB 20 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.3.1.min.js
telus-update-billing-payment-ssl-443-cert-info-secure.mak164.top/SiteIdentity/src/ |
85 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
j.js
telus-update-billing-payment-ssl-443-cert-info-secure.mak164.top/SiteIdentity/src/ |
3 KB 586 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles_9bd8b84a9c03352228b4.css
telus-update-billing-payment-ssl-443-cert-info-secure.mak164.top/SiteIdentity/src/ |
56 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Logo_TELUS.svg
telus-update-billing-payment-ssl-443-cert-info-secure.mak164.top/SiteIdentity/src/ |
2 KB 1014 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Logo_TELUS_white.svg
telus-update-billing-payment-ssl-443-cert-info-secure.mak164.top/SiteIdentity/src/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
Login.php
telus-update-billing-payment-ssl-443-cert-info-secure.mak164.top/SiteIdentity/ |
178 KB 20 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.3.1.min.js
telus-update-billing-payment-ssl-443-cert-info-secure.mak164.top/SiteIdentity/src/ |
85 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
j.js
telus-update-billing-payment-ssl-443-cert-info-secure.mak164.top/SiteIdentity/src/ |
3 KB 546 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles_9bd8b84a9c03352228b4.css
telus-update-billing-payment-ssl-443-cert-info-secure.mak164.top/SiteIdentity/src/ |
56 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Logo_TELUS.svg
telus-update-billing-payment-ssl-443-cert-info-secure.mak164.top/SiteIdentity/src/ |
2 KB 1002 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Logo_TELUS_white.svg
telus-update-billing-payment-ssl-443-cert-info-secure.mak164.top/SiteIdentity/src/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wave_header_default.png
telus-update-billing-payment-ssl-443-cert-info-secure.mak164.top/SiteIdentity/src/ |
20 KB 20 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
b8765d4b-d9a3-48b9-ac65-560e7517cf0e.woff2
telus-update-billing-payment-ssl-443-cert-info-secure.mak164.top/SiteIdentity/src/ |
19 KB 19 KB |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dc50c02f-3f77-4e75-b89c-e3f9bb4752e6.woff2
telus-update-billing-payment-ssl-443-cert-info-secure.mak164.top/SiteIdentity/src/ |
19 KB 19 KB |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
core-icons.woff2
telus-update-billing-payment-ssl-443-cert-info-secure.mak164.top/SiteIdentity/src/ |
4 KB 4 KB |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
3e8a8b56-3cb0-4347-b670-eaaf06b76e9b.woff2
telus-update-billing-payment-ssl-443-cert-info-secure.mak164.top/SiteIdentity/src/ |
19 KB 19 KB |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
aff68211-86bb-476d-882e-f7a3face144c.woff2
telus-update-billing-payment-ssl-443-cert-info-secure.mak164.top/SiteIdentity/src/ |
49 KB 49 KB |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Telus (Telecommunication)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| $ function| jQuery function| userIDfocus function| passIDfocus function| userIDfocusout function| passIDfocusout function| userIDkeypress function| passIDkeypress function| userIDcheck function| passIDcheck function| showp1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.mak164.top/ | Name: __cfduid Value: dbd724c4488a0e86f86b71fc36cb82ff01577214329 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=63072000; includeSubdomains |
X-Content-Type-Options | nosniff |
X-Frame-Options | DENY |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
telus-update-billing-payment-ssl-443-cert-info-secure.mak164.top
wiseware.net
2606:4700:30::681b:bc4e
54.157.210.181
11915af6b9b36831211194b0a13bd2fefc24679a5a1539d27aef8106cd5ab937
1de390dad90ec84e08245dcd7cd1cbcc3d6663302702bfc81a7e1cf0c106743a
31bf43ce5c4741bfd9fda40462c63bfb1e518f0e4ca88a09ff7f963cd3b3f67b
44968214d4d5a6c9a466025084ccde7360fb1365c13375062dd050004889531f
4fe68fa216176e6d1f4580e924bafecc9f519984ecc06b1a840a08b0d88c95de
56b0625243f403285df4a6ec2b3bb68b17501a6a95ba30252a917c06d4395f58
6c016e882feb0ab343347e74848df7b5f252382d45c9c671be1aa141bcf16d05
726b4339c7bca67dbba88d1f121857e2130d7ac194df7a512461ae621cfc2ff1
7adbc085f4ca58718317d3c12bafe06e65bffc31b1310d5ef3a005f18155e554
cbe1b0f1185a0b862a1e9ed248098ff59f79de8c00cd0ea2dd873023e704d3f4
d8985cae9eda7ce2bb937053b26c94a391b53c4e2563ed77c6527db0e41a16e4
e81130ab078cfaf535fc6b4d346f8032e9099f5e429cdb24d5c1deb80f86ac7d
f776d0dfb485629c7351534355429068fd43071b7613e3d2042986fd5b5bf46c