broadband-52dbbd.webflow.io
Open in
urlscan Pro
151.101.130.188
Malicious Activity!
Public Scan
Submission: On August 16 via api from US — Scanned from DE
Summary
TLS certificate: Issued by GlobalSign Atlas R3 DV TLS CA 2023 Q4 on November 29th 2023. Valid for: a year.
This is the only time broadband-52dbbd.webflow.io was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: BT (Telecommunication)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 151.101.130.188 151.101.130.188 | 54113 (FASTLY) (FASTLY) | |
6 | 2600:9000:20b... 2600:9000:20b4:c600:12:9e5f:cac0:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
3 | 2a00:1450:400... 2a00:1450:4001:811::2004 | 15169 (GOOGLE) (GOOGLE) | |
1 | 52.222.153.146 52.222.153.146 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2a00:1450:400... 2a00:1450:4001:80b::2003 | 15169 (GOOGLE) (GOOGLE) | |
12 | 5 |
ASN16509 (AMAZON-02, US)
assets-global.website-files.com |
ASN16509 (AMAZON-02, US)
PTR: server-52-222-153-146.cdg52.r.cloudfront.net
d3e54v103j8qbb.cloudfront.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
website-files.com
assets-global.website-files.com — Cisco Umbrella Rank: 33607 |
164 KB |
3 |
google.com
www.google.com — Cisco Umbrella Rank: 10 |
961 B |
1 |
gstatic.com
www.gstatic.com |
212 KB |
1 |
cloudfront.net
d3e54v103j8qbb.cloudfront.net |
31 KB |
1 |
webflow.io
broadband-52dbbd.webflow.io |
2 KB |
12 | 5 |
Domain | Requested by | |
---|---|---|
6 | assets-global.website-files.com |
broadband-52dbbd.webflow.io
|
3 | www.google.com |
broadband-52dbbd.webflow.io
www.gstatic.com |
1 | www.gstatic.com |
www.google.com
|
1 | d3e54v103j8qbb.cloudfront.net |
broadband-52dbbd.webflow.io
|
1 | broadband-52dbbd.webflow.io | |
12 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.webflow.io GlobalSign Atlas R3 DV TLS CA 2023 Q4 |
2023-11-29 - 2024-12-30 |
a year | crt.sh |
*.website-files.com Amazon RSA 2048 M02 |
2024-08-10 - 2025-09-07 |
a year | crt.sh |
*.google.com WR2 |
2024-07-30 - 2024-10-22 |
3 months | crt.sh |
*.cloudfront.net Amazon RSA 2048 M01 |
2024-07-30 - 2025-07-03 |
a year | crt.sh |
*.gstatic.com WR2 |
2024-07-30 - 2024-10-22 |
3 months | crt.sh |
This page contains 3 frames:
Primary Page:
https://broadband-52dbbd.webflow.io/
Frame ID: 0DF35B31B212AD1C4BFCD1DA227AA4AD
Requests: 10 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lew6kYpAAAAAP5g8vqbKHbLstkkMmmc5elmtRij&co=aHR0cHM6Ly9icm9hZGJhbmQtNTJkYmJkLndlYmZsb3cuaW86NDQz&hl=de&v=hfUfsXWZFeg83qqxrK27GB8P&size=normal&cb=8q0jak1nrlse
Frame ID: 63119551FE2E9A35B70A7257B20F198E
Requests: 1 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/api2/bframe?hl=de&v=hfUfsXWZFeg83qqxrK27GB8P&k=6Lew6kYpAAAAAP5g8vqbKHbLstkkMmmc5elmtRij
Frame ID: 0D0AD9EBD16EFEF515AF54B8CD22546D
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
BroadbandDetected technologies
jQuery (JavaScript Libraries) ExpandDetected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
reCAPTCHA (Captchas) Expand
Detected patterns
- /recaptcha/api\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
broadband-52dbbd.webflow.io/ |
6 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
broadband-52dbbd.webflow.ce8f21d51.css
assets-global.website-files.com/6597cc7a635a4186d07f56fa/css/ |
36 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
api.js
www.google.com/recaptcha/ |
1 KB 961 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.5.1.min.dc5e7f18c8.js
d3e54v103j8qbb.cloudfront.net/js/ |
87 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
webflow.4bdb9bf8f.js
assets-global.website-files.com/6597cc7a635a4186d07f56fa/js/ |
45 KB 17 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
recaptcha__de.js
www.gstatic.com/recaptcha/releases/hfUfsXWZFeg83qqxrK27GB8P/ |
533 KB 212 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6597cde3a01e421b28697648_Screenshot%202023-08-16%20at%2009-06-09%20Fibre%20Broadband%20TV%20Packages%20TNT%20Sports%20%26%20Mobile%20Deals%20BT-p-1600.png
assets-global.website-files.com/6597cc7a635a4186d07f56fa/ |
26 KB 27 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6597cde44e1e0284aa3695ca_Screenshot%202023-11-04%20at%2004-59-24%20Email%20Login%20Page-p-800.png
assets-global.website-files.com/6597cc7a635a4186d07f56fa/ |
74 KB 74 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6597cde3563b39de25be653d_Screenshot%202023-11-04%20at%2004-58-11%20Email%20Login%20Page-p-1600.png
assets-global.website-files.com/6597cc7a635a4186d07f56fa/ |
33 KB 34 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
anchor
www.google.com/recaptcha/api2/ Frame 6311 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bframe
www.google.com/recaptcha/api2/ Frame 0D0A |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6597d071507f8e07fe512c4d_bt-logo.png
assets-global.website-files.com/6597cc7a635a4186d07f56fa/ |
3 KB 4 KB |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: BT (Telecommunication)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| 2 object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client function| $ function| jQuery function| tram object| Webflow object| recaptcha object| closure_lm_3665670 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | frame-ancestors 'self' https://*.webflow.com http://*.webflow.com http://*.webflow.io http://webflow.com https://webflow.com |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
assets-global.website-files.com
broadband-52dbbd.webflow.io
d3e54v103j8qbb.cloudfront.net
www.google.com
www.gstatic.com
151.101.130.188
2600:9000:20b4:c600:12:9e5f:cac0:93a1
2a00:1450:4001:80b::2003
2a00:1450:4001:811::2004
52.222.153.146
09ac8d9a076e3c66bb4ad9da621954214ce4d0faebdd6f621dac99503db4ded2
113e8eb51fcaaa31bd8c1fa4834f81cca1a0b75d70823c7c4702b715baec6b2f
150ead8d6a6d8d083b396fde7911a8affb6be80b0ab984aec4b5ed5f5e023028
33ad552f672db7f6889f78609875828feb5a89b83f3294b48606386b63e54670
3c757cf35846742d586773f8146e88a5bc39308cf182ceb47686a407e0ebe1df
430fff120920f40d91e4df91019e9e94c39e8a0e2a9520be923dd401248c1571
618a7651d400c72397a36e86d168ed7df8a78f6d7058e7274f5e7157442ce8fe
ab42d7c37f7928197cf2fb60407d97ebf6b8316f5bd3007d33b49d4ca0559e03
cd09d55dabb97cec1c25432cee39e9c30f22e70f1eeb6a22d056399786712b45
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d