11drv-emailbt-nde0.vercel.app Open in urlscan Pro
76.76.21.142 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://tinyurl.com/mvdjjuy5
Effective URL:
https://11drv-emailbt-nde0.vercel.app/?.mail-userservices/?_task=mail&_mbox
Submission Tags: @phish_report
Submission: On October 28 via api (October 28th 2024, 2:50:10 pm UTC) from FI — Scanned from FI

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 5 domains to perform 11 HTTP transactions. The main IP is 76.76.21.142, located in Walnut, United States and belongs to AMAZON-02, US. The main domain is 11drv-emailbt-nde0.vercel.app.
TLS certificate: Issued by R11 on October 17th 2024. Valid for: 3 months.

This is the only time 11drv-emailbt-nde0.vercel.app was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BT (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
1 1	104.18.111.161 104.18.111.161	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	54.209.247.77 54.209.247.77	14618 (AMAZON-AES) (AMAZON-AES)
1	76.76.21.142 76.76.21.142	16509 (AMAZON-02) (AMAZON-02)
4	2620:1ec:29:1... 2620:1ec:29:1::45	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	104.26.13.205 104.26.13.205	13335 (CLOUDFLAR...) (CLOUDFLARENET)
11	5

1 104.18.111.161 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

tinyurl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.209.247.77 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-209-247-77.compute-1.amazonaws.com

funky-onyx-honeycrisp.glitch.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 76.76.21.142 (Walnut, United States)

ASN16509 (AMAZON-02, US)

11drv-emailbt-nde0.vercel.app	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:29:1::45 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

prod-btemailauth.bt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.26.13.205 (None, )

ASN13335 (CLOUDFLARENET, US)

api.ipify.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	bt.com prod-btemailauth.bt.com — Cisco Umbrella Rank: 253345	93 KB
1	ipify.org api.ipify.org — Cisco Umbrella Rank: 2041	165 B
1	vercel.app 11drv-emailbt-nde0.vercel.app	3 KB
1	glitch.me funky-onyx-honeycrisp.glitch.me	466 B
1	tinyurl.com 1 redirects tinyurl.com — Cisco Umbrella Rank: 17963	819 B
11	5

	Domain	Requested by
4	prod-btemailauth.bt.com	11drv-emailbt-nde0.vercel.app prod-btemailauth.bt.com
1	api.ipify.org	11drv-emailbt-nde0.vercel.app
1	11drv-emailbt-nde0.vercel.app	funky-onyx-honeycrisp.glitch.me
1	funky-onyx-honeycrisp.glitch.me
1	tinyurl.com	1 redirects
11	5

This site contains no links.

Subject Issuer	Validity	Valid
glitch.com Amazon RSA 2048 M03	`2023-12-04` - `2025-01-01`	a year	crt.sh
*.vercel.app R11	`2024-10-17` - `2025-01-15`	3 months	crt.sh
prod-btemailauth.bt.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2024-08-09` - `2025-02-09`	6 months	crt.sh
ipify.org WE1	`2024-09-15` - `2024-12-14`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://11drv-emailbt-nde0.vercel.app/?.mail-userservices/?_task=mail&_mbox
Frame ID: 7C8D0223408F8F472380A77D25ECFC23
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Secure Authentication

Page URL History Show full URLs

https://tinyurl.com/mvdjjuy5 HTTP 301
https://funky-onyx-honeycrisp.glitch.me/boi.html Page URL
https://11drv-emailbt-nde0.vercel.app/?.mail-userservices/?_task=mail&_mbox Page URL

Page Statistics

11
Requests

64 %
HTTPS

20 %
IPv6

5
Domains

5
Subdomains

5
IPs

2
Countries

97 kB
Transfer

103 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://tinyurl.com/mvdjjuy5 HTTP 301
https://funky-onyx-honeycrisp.glitch.me/boi.html Page URL
https://11drv-emailbt-nde0.vercel.app/?.mail-userservices/?_task=mail&_mbox Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://tinyurl.com/mvdjjuy5 HTTP 301
https://funky-onyx-honeycrisp.glitch.me/boi.html

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

boi.html Show response
funky-onyx-honeycrisp.glitch.me/
Redirect Chain

https://tinyurl.com/mvdjjuy5
https://funky-onyx-honeycrisp.glitch.me/boi.html

107 B
466 B

476ms
192ms

Document
text/html

54.209.247.77
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://funky-onyx-honeycrisp.glitch.me/boi.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.209.247.77 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-209-247-77.compute-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 8fe21e50a876033a8900a919f92aef670d7144f3caf6f57cd10a902b8d18dd14

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

accept-ranges: bytes
cache-control: no-cache
content-length: 107
content-type: text/html; charset=utf-8
date: Mon, 28 Oct 2024 14:50:05 GMT
etag: "c7aedea819fa63acfac2146bb91c2eef"
last-modified: Mon, 28 Oct 2024 12:47:56 GMT
server: AmazonS3
x-amz-id-2: Vbgb6cUZGGikPds1BbG5hVCKZRfTg9a3oqdtkwrv0pIQl7mNHvGPacjGYbjMLoPr1e8Sdvc3gxA=
x-amz-request-id: AZ4MATWD5BCEYMZP
x-amz-server-side-encryption: AES256
x-amz-version-id: 1bYny2Fou1qcUk1TnwmzmHvAZVftbgeP

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: max-age=0, must-revalidate, no-cache, no-store, private
cf-cache-status: HIT
cf-ray: 8d9bbc724a9482a0-ARN
content-type: text/html; charset=utf-8
date: Mon, 28 Oct 2024 14:50:04 GMT
location: https://funky-onyx-honeycrisp.glitch.me/boi.html
referrer-policy: unsafe-url
server: cloudflare
server-timing: cfCacheStatus;desc="HIT"
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-robots-tag: noindex
x-tinyurl-redirect: eyJpdiI6IjhHenY1LzlMc3phbjZLZXMvY1dqNEE9PSIsInZhbHVlIjoiMkNjd0hCZUZvcm1zSjV0aHA3Wit1bjBwUU9aOVlvZytsSzllSkxFMEJzSy9iYkFrcE1NaktHQ015a1J3dnZlOFF4WnY5RnBOZ1k2dVlVMmQ4clJKd3c9PSIsIm1hYyI6IjZjNjhlNTYzMWZhMDJhYmQ5YzkzMmI4MDE2OTZkZDMwMTNjMDM2YmMyMWZiMzU1N2Y0NTg0OWEwZDNjYzA0OWYiLCJ0YWciOiIifQ==
x-tinyurl-redirect-type: redirect
x-xss-protection: 1; mode=block

GET
H2 200 Primary Request / Show response
11drv-emailbt-nde0.vercel.app/ 5 KB
3 KB 140ms
49ms Document
text/html 76.76.21.142
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://11drv-emailbt-nde0.vercel.app/?.mail-userservices/?_task=mail&_mbox

Requested by

Host: funky-onyx-honeycrisp.glitch.me
URL: https://funky-onyx-honeycrisp.glitch.me/boi.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

76.76.21.142 Walnut, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Vercel /

Resource Hash

4b485ac8870d38f29362493d1201e230b583a4f1693930b61119f2373871193a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://funky-onyx-honeycrisp.glitch.me/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

access-control-allow-origin: *
age: 1384
cache-control: public, max-age=0, must-revalidate
content-disposition: inline
content-encoding: br
content-type: text/html; charset=utf-8
date: Mon, 28 Oct 2024 14:50:05 GMT
etag: W/"81b84c97e65672bf193e25239ebe74a7"
last-modified: Mon, 28 Oct 2024 14:27:00 GMT
server: Vercel
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-vercel-cache: HIT
x-vercel-id: arn1::b5gcf-1730127005288-c308ac960724

GET
H2 200 unified.css
prod-btemailauth.bt.com/static/content/res/stage-1/css/ 10 KB
3 KB 351ms
66ms Stylesheet
text/css 2620:1ec:29:1::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://prod-btemailauth.bt.com/static/content/res/stage-1/css/unified.css

Requested by

Host: 11drv-emailbt-nde0.vercel.app
URL: https://11drv-emailbt-nde0.vercel.app/?.mail-userservices/?_task=mail&_mbox

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:29:1::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

6c2f4d1bba9b0581e1dcb4ef1722afff74c63658d656c5dca1b3012c3f716f69

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://sdk.onfido.com https://assets.onfido.com; connect-src 'self' https://api.onfido.com https://api.us.onfido.com https://api.ca.onfido.com http://onfido.com; script-src 'self' 'unsafe-inline' https://sdk.onfido.com https://assets.onfido.com;
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer: https://11drv-emailbt-nde0.vercel.app/

Response headers

x-azure-ref: 20241028T145005Z-er1787bdbf4qb44qwgsrft4az800000004k000000000y87p
content-security-policy: default-src 'self' https://sdk.onfido.com https://assets.onfido.com; connect-src 'self' https://api.onfido.com https://api.us.onfido.com https://api.ca.onfido.com http://onfido.com; script-src 'self' 'unsafe-inline' https://sdk.onfido.com https://assets.onfido.com;
cache-control: public, max-age=60, immutable
content-encoding: br
etag: W/"2645-192c07d9f19"
x-fd-int-roxy-purgeid: 66922793
x-content-type-options: nosniff
request-context: appId=cid-v1:
x-ms-middleware-request-id: 00000000-0000-0000-0000-000000000000
x-cache: TCP_REVALIDATED_HIT
date: Mon, 28 Oct 2024 14:50:05 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding, Origin
last-modified: Thu, 24 Oct 2024 21:45:11 GMT

GET
H2 200 / Show response
api.ipify.org/ 30 B
165 B 309ms
168ms Script
application/javascript 104.26.13.205
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.ipify.org/?format=jsonp&callback=getIP
Requested by: Host: 11drv-emailbt-nde0.vercel.app
URL: https://11drv-emailbt-nde0.vercel.app/?.mail-userservices/?_task=mail&_mbox
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.13.205 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4268f87c7408cf2038e1ece3561046fedbd738ad555ab2525407277c6dd62cf6

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer: https://11drv-emailbt-nde0.vercel.app/

Response headers

cf-ray: 8d9bbc788d42cac9-HAM
content-length: 30
cf-cache-status: DYNAMIC
date: Mon, 28 Oct 2024 14:50:05 GMT
content-type: application/javascript
vary: Origin
server: cloudflare

GET
H2 200 logo.png
prod-btemailauth.bt.com/static/content/res/stage-1/img/ 2 KB
2 KB 351ms
67ms Image
image/png 2620:1ec:29:1::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://prod-btemailauth.bt.com/static/content/res/stage-1/img/logo.png

Requested by

Host: 11drv-emailbt-nde0.vercel.app
URL: https://11drv-emailbt-nde0.vercel.app/?.mail-userservices/?_task=mail&_mbox

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:29:1::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

5ebc32282d33de7282b6004a68ac8b6a5efa2c6084a58548ef3a7c8e322b51c0

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://sdk.onfido.com https://assets.onfido.com; connect-src 'self' https://api.onfido.com https://api.us.onfido.com https://api.ca.onfido.com http://onfido.com; script-src 'self' 'unsafe-inline' https://sdk.onfido.com https://assets.onfido.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer: https://11drv-emailbt-nde0.vercel.app/

Response headers

x-cache-info: L1_T2
etag: W/"60f-192c0703b7c"
x-fd-int-roxy-purgeid: 66922793
x-content-type-options: nosniff
x-ms-middleware-request-id: 00000000-0000-0000-0000-000000000000
x-cache: TCP_HIT
date: Mon, 28 Oct 2024 14:50:05 GMT
content-type: image/png
last-modified: Thu, 24 Oct 2024 21:30:33 GMT
vary: Origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: default-src 'self' https://sdk.onfido.com https://assets.onfido.com; connect-src 'self' https://api.onfido.com https://api.us.onfido.com https://api.ca.onfido.com http://onfido.com; script-src 'self' 'unsafe-inline' https://sdk.onfido.com https://assets.onfido.com;
cache-control: public, max-age=60, immutable
request-context: appId=cid-v1:
accept-ranges: bytes
content-length: 1551
x-azure-ref: 20241028T145005Z-er1787bdbf4qb44qwgsrft4az800000004k000000000y87q

GET
H2 200 background.jpg
prod-btemailauth.bt.com/static/content/res/stage-1/img/ 51 KB
52 KB 75ms
75ms Image
image/jpeg 2620:1ec:29:1::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://prod-btemailauth.bt.com/static/content/res/stage-1/img/background.jpg

Requested by

Host: prod-btemailauth.bt.com
URL: https://prod-btemailauth.bt.com/static/content/res/stage-1/css/unified.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:29:1::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

85502e873e3136f2e556290017fa66e9bdbca49c8d2bb2351f9a6f4ff7072f1f

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://sdk.onfido.com https://assets.onfido.com; connect-src 'self' https://api.onfido.com https://api.us.onfido.com https://api.ca.onfido.com http://onfido.com; script-src 'self' 'unsafe-inline' https://sdk.onfido.com https://assets.onfido.com;
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer: https://prod-btemailauth.bt.com/static/content/res/stage-1/css/unified.css

Response headers

x-cache-info: L1_T2
etag: W/"cc90-192c0b4dc73"
x-fd-int-roxy-purgeid: 66922793
x-content-type-options: nosniff
x-ms-middleware-request-id: 00000000-0000-0000-0000-000000000000
x-cache: TCP_HIT
date: Mon, 28 Oct 2024 14:50:05 GMT
content-type: image/jpeg
last-modified: Thu, 24 Oct 2024 22:45:31 GMT
vary: Origin
content-security-policy: default-src 'self' https://sdk.onfido.com https://assets.onfido.com; connect-src 'self' https://api.onfido.com https://api.us.onfido.com https://api.ca.onfido.com http://onfido.com; script-src 'self' 'unsafe-inline' https://sdk.onfido.com https://assets.onfido.com;
cache-control: public, max-age=60, immutable
request-context: appId=cid-v1:
accept-ranges: bytes
content-length: 52368
x-azure-ref: 20241028T145005Z-er1787bdbf4qb44qwgsrft4az800000004k000000000y886

GET BTCurve_W_Headline.woff2
prod-btemailauth.bt.com/static/content/res/stage-1/fonts/ 0
0

GET BTCurve_W_Rg.woff2
prod-btemailauth.bt.com/static/content/res/stage-1/fonts/ 0
0

GET BTCurve_W_Rg.woff
prod-btemailauth.bt.com/static/content/res/stage-1/fonts/ 0
0

GET BTCurve_W_Headline.woff
prod-btemailauth.bt.com/static/content/res/stage-1/fonts/ 0
0

GET
H2 200 favicon.ico
prod-btemailauth.bt.com/static/content/res/stage-1/img/ 35 KB
36 KB 74ms
74ms Other
image/x-icon 2620:1ec:29:1::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://prod-btemailauth.bt.com/static/content/res/stage-1/img/favicon.ico

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:29:1::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

7e025a3767f1628a8f74f19fd86cecd06616dd2fbdaa584c9f95d3903f317080

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://sdk.onfido.com https://assets.onfido.com; connect-src 'self' https://api.onfido.com https://api.us.onfido.com https://api.ca.onfido.com http://onfido.com; script-src 'self' 'unsafe-inline' https://sdk.onfido.com https://assets.onfido.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer: https://11drv-emailbt-nde0.vercel.app/

Response headers

x-cache-info: L1_T2
etag: W/"8dd4-192c0703b7c"
x-fd-int-roxy-purgeid: 66922793
x-content-type-options: nosniff
x-ms-middleware-request-id: 00000000-0000-0000-0000-000000000000
x-cache: TCP_HIT
date: Mon, 28 Oct 2024 14:50:06 GMT
content-type: image/x-icon
last-modified: Thu, 24 Oct 2024 21:30:33 GMT
vary: Origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: default-src 'self' https://sdk.onfido.com https://assets.onfido.com; connect-src 'self' https://api.onfido.com https://api.us.onfido.com https://api.ca.onfido.com http://onfido.com; script-src 'self' 'unsafe-inline' https://sdk.onfido.com https://assets.onfido.com;
cache-control: public, max-age=60, immutable
request-context: appId=cid-v1:
accept-ranges: bytes
content-length: 36308
x-azure-ref: 20241028T145006Z-er1787bdbf4qb44qwgsrft4az800000004k000000000y8a7

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: prod-btemailauth.bt.com
URL: https://prod-btemailauth.bt.com/static/content/res/stage-1/fonts/BTCurve_W_Headline.woff2

Domain: prod-btemailauth.bt.com
URL: https://prod-btemailauth.bt.com/static/content/res/stage-1/fonts/BTCurve_W_Rg.woff2

Domain: prod-btemailauth.bt.com
URL: https://prod-btemailauth.bt.com/static/content/res/stage-1/fonts/BTCurve_W_Rg.woff

Domain: prod-btemailauth.bt.com
URL: https://prod-btemailauth.bt.com/static/content/res/stage-1/fonts/BTCurve_W_Headline.woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BT (Telecommunication)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| getIP

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.tinyurl.com/	1970-01-21 00:35:28	Name: __cf_bm Value: KUPK.aC3mgRyb47tI8jBTzObTYHqMeLau76pVNYjZvU-1730127004-1.0.1.1-F2qIUkWt3ZyaOXdi0PlyDG1IAIefJ0HMjPAe37Hbr0P3Iru2PjyfmoSsP0Hoksj5JK22HxmQ2_BCT25TriASoQ

11 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://11drv-emailbt-nde0.vercel.app/?.mail-userservices/?_task=mail&_mbox(Line 3) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://api.ipify.org/?format=jsonp&callback=getIP, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://11drv-emailbt-nde0.vercel.app/?.mail-userservices/?_task=mail&_mbox(Line 3) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://api.ipify.org/?format=jsonp&callback=getIP, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
recommendation	verbose	URL: https://11drv-emailbt-nde0.vercel.app/?.mail-userservices/?_task=mail&_mbox Message: [DOM] Input elements should have autocomplete attributes (suggested: "username"): (More info: https://goo.gl/9p2vKq) %o
javascript	error	URL: https://11drv-emailbt-nde0.vercel.app/?.mail-userservices/?_task=mail&_mbox Message: Access to font at 'https://prod-btemailauth.bt.com/static/content/res/stage-1/fonts/BTCurve_W_Rg.woff2' from origin 'https://11drv-emailbt-nde0.vercel.app' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://prod-btemailauth.bt.com/static/content/res/stage-1/fonts/BTCurve_W_Rg.woff2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://11drv-emailbt-nde0.vercel.app/?.mail-userservices/?_task=mail&_mbox Message: Access to font at 'https://prod-btemailauth.bt.com/static/content/res/stage-1/fonts/BTCurve_W_Headline.woff2' from origin 'https://11drv-emailbt-nde0.vercel.app' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://prod-btemailauth.bt.com/static/content/res/stage-1/fonts/BTCurve_W_Headline.woff2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://11drv-emailbt-nde0.vercel.app/?.mail-userservices/?_task=mail&_mbox Message: Access to font at 'https://prod-btemailauth.bt.com/static/content/res/stage-1/fonts/BTCurve_W_Headline.woff' from origin 'https://11drv-emailbt-nde0.vercel.app' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://prod-btemailauth.bt.com/static/content/res/stage-1/fonts/BTCurve_W_Headline.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://11drv-emailbt-nde0.vercel.app/?.mail-userservices/?_task=mail&_mbox Message: Access to font at 'https://prod-btemailauth.bt.com/static/content/res/stage-1/fonts/BTCurve_W_Rg.woff' from origin 'https://11drv-emailbt-nde0.vercel.app' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://prod-btemailauth.bt.com/static/content/res/stage-1/fonts/BTCurve_W_Rg.woff Message: Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

11drv-emailbt-nde0.vercel.app
api.ipify.org
funky-onyx-honeycrisp.glitch.me
prod-btemailauth.bt.com
tinyurl.com
prod-btemailauth.bt.com
104.18.111.161
104.26.13.205
2620:1ec:29:1::45
54.209.247.77
76.76.21.142
4268f87c7408cf2038e1ece3561046fedbd738ad555ab2525407277c6dd62cf6
4b485ac8870d38f29362493d1201e230b583a4f1693930b61119f2373871193a
5ebc32282d33de7282b6004a68ac8b6a5efa2c6084a58548ef3a7c8e322b51c0
6c2f4d1bba9b0581e1dcb4ef1722afff74c63658d656c5dca1b3012c3f716f69
7e025a3767f1628a8f74f19fd86cecd06616dd2fbdaa584c9f95d3903f317080
85502e873e3136f2e556290017fa66e9bdbca49c8d2bb2351f9a6f4ff7072f1f
8fe21e50a876033a8900a919f92aef670d7144f3caf6f57cd10a902b8d18dd14

11drv-emailbt-nde0.vercel.app Open in urlscan Pro 76.76.21.142 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

11 Requests

64 %HTTPS

20 %IPv6

5 Domains

5 Subdomains

5 IPs

2 Countries

97 kBTransfer

103 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

1 Cookies

11 Console Messages

Indicators

11drv-emailbt-nde0.vercel.app Open in urlscan Pro
76.76.21.142 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

64 %
HTTPS

20 %
IPv6

5
Domains

5
Subdomains

5
IPs

2
Countries

97 kB
Transfer

103 kB
Size

1
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!