login-page-security.webflow.io Open in urlscan Pro
151.101.2.188 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://login-page-security.webflow.io/
Submission: On July 25 via api (July 25th 2024, 10:05:48 am UTC) from BE — Scanned from US

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 1 countries across 5 domains to perform 12 HTTP transactions. The main IP is 151.101.2.188, located in San Francisco, United States and belongs to FASTLY, US. The main domain is login-page-security.webflow.io.
TLS certificate: Issued by GlobalSign Atlas R3 DV TLS CA 2023 Q4 on November 29th 2023. Valid for: a year.

This is the only time login-page-security.webflow.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BT (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
1	151.101.2.188 151.101.2.188	54113 (FASTLY) (FASTLY)
6	2600:9000:250... 2600:9000:2509:1000:12:9e5f:cac0:93a1	16509 (AMAZON-02) (AMAZON-02)
3	172.253.63.147 172.253.63.147	15169 (GOOGLE) (GOOGLE)
1	108.138.61.152 108.138.61.152	16509 (AMAZON-02) (AMAZON-02)
1	2607:f8b0:400... 2607:f8b0:4004:c06::5e	15169 (GOOGLE) (GOOGLE)
12	5

1 151.101.2.188 (San Francisco, United States)

ASN54113 (FASTLY, US)

login-page-security.webflow.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2600:9000:2509:1000:12:9e5f:cac0:93a1 (United States)

ASN16509 (AMAZON-02, US)

assets-global.website-files.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.253.63.147 (United States)

ASN15169 (GOOGLE, US)
PTR: bi-in-f147.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.138.61.152 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-61-152.iad12.r.cloudfront.net

d3e54v103j8qbb.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c06::5e (Washington, United States)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	website-files.com assets-global.website-files.com — Cisco Umbrella Rank: 33607	210 KB
3	google.com www.google.com — Cisco Umbrella Rank: 10	961 B
1	gstatic.com www.gstatic.com	211 KB
1	cloudfront.net d3e54v103j8qbb.cloudfront.net	30 KB
1	webflow.io login-page-security.webflow.io	2 KB
12	5

	Domain	Requested by
6	assets-global.website-files.com	login-page-security.webflow.io
3	www.google.com	login-page-security.webflow.io www.gstatic.com
1	www.gstatic.com	www.google.com
1	d3e54v103j8qbb.cloudfront.net	login-page-security.webflow.io
1	login-page-security.webflow.io
12	5

This site contains no links.

Subject Issuer	Validity	Valid
*.webflow.io GlobalSign Atlas R3 DV TLS CA 2023 Q4	`2023-11-29` - `2024-12-30`	a year	crt.sh
*.website-files.com Amazon RSA 2048 M03	`2023-09-11` - `2024-10-08`	a year	crt.sh
*.google.com WR2	`2024-06-24` - `2024-09-16`	3 months	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2023-10-10` - `2024-09-19`	a year	crt.sh
*.gstatic.com WR2	`2024-06-24` - `2024-09-16`	3 months	crt.sh

This page contains 3 frames:

Primary Page: https://login-page-security.webflow.io/
Frame ID: D37D4F28872C999AF7254FE1577456FE
Requests: 10 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LeWuUUpAAAAAMa425S053Lfrie2QNY1_xB2__t-&co=aHR0cHM6Ly9sb2dpbi1wYWdlLXNlY3VyaXR5LndlYmZsb3cuaW86NDQz&hl=en&v=Xv-KF0LlBu_a0FJ9I5YSlX5m&size=normal&cb=c777m0roobat
Frame ID: AB2FAE9BDE5B1B01A33A7F13900971A8
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=en&v=Xv-KF0LlBu_a0FJ9I5YSlX5m&k=6LeWuUUpAAAAAMa425S053Lfrie2QNY1_xB2__t-
Frame ID: 8D3978E713FC9678BC4F0BA8B7B0E916
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login Page Security

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

/recaptcha/api\.js

Page Statistics

12
Requests

100 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

5
IPs

1
Countries

454 kB
Transfer

890 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
login-page-security.webflow.io/ 6 KB
2 KB 689ms
470ms Document
text/html 151.101.2.188
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://login-page-security.webflow.io/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.2.188 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

a403618873287deb79fab03668c95d4b531e372dfff713af0d2825809734626c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://.webflow.com http://.webflow.com http://*.webflow.io http://webflow.com https://webflow.com

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 0
content-encoding: gzip
content-length: 1748
content-security-policy: frame-ancestors 'self' https://*.webflow.com http://*.webflow.com http://*.webflow.io http://webflow.com https://webflow.com
content-type: text/html
date: Thu, 25 Jul 2024 10:05:43 GMT
vary: x-wf-forwarded-proto, Accept-Encoding
x-cache: MISS
x-cache-hits: 0
x-lambda-id: 59487cde-7135-416a-bb30-7f719be9d406
x-served-by: cache-lax-kwhp1940028-LAX
x-timer: S1721901943.632907,VS0,VE408

GET
H2 200 login-page-security.webflow.ce8f21d51.css
assets-global.website-files.com/65969fd4529344105db81549/css/ 36 KB
9 KB 498ms
163ms Stylesheet
text/css 2600:9000:2509:1000:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets-global.website-files.com/65969fd4529344105db81549/css/login-page-security.webflow.ce8f21d51.css
Requested by: Host: login-page-security.webflow.io
URL: https://login-page-security.webflow.io/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2509:1000:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 150ead8d6a6d8d083b396fde7911a8affb6be80b0ab984aec4b5ed5f5e023028

Request headers

Referer: https://login-page-security.webflow.io/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 25 Jul 2024 10:05:44 GMT
content-encoding: gzip
via: 1.1 3542174e2d71e2c3dffc0069aa7cbb34.cloudfront.net (CloudFront)
x-amz-version-id: vyf9tFd_ViCgUeDqYRsbyhdEINkvq9ex
x-amz-cf-pop: IAD12-P2
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
content-length: 8329
last-modified: Thu, 04 Jan 2024 14:38:16 GMT
server: AmazonS3
etag: "3b3b3a2917adfa11f0c13fac1280bf94"
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
accept-ranges: bytes
x-amz-cf-id: Q38a2rjLDisV_26IsfjQNPDxtOgNHYjAMEJotTURT34eOe58vjkyRg==

GET
H3 200 api.js Show response
www.google.com/recaptcha/ 1 KB
961 B 396ms
138ms Script
text/javascript 172.253.63.147
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js

Requested by

Host: login-page-security.webflow.io
URL: https://login-page-security.webflow.io/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.147 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f147.1e100.net

Software

GSE /

Resource Hash

ea34d58b0a0b3d96855b53d94ed2aad2e0548ea33029f69d0eba0798329df187

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://login-page-security.webflow.io/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 25 Jul 2024 10:05:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Thu, 25 Jul 2024 10:05:43 GMT

GET
H2 200 jquery-3.5.1.min.dc5e7f18c8.js Show response
d3e54v103j8qbb.cloudfront.net/js/ 87 KB
30 KB 431ms
138ms Script
application/javascript 108.138.61.152
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8.js?site=65969fd4529344105db81549
Requested by: Host: login-page-security.webflow.io
URL: https://login-page-security.webflow.io/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.61.152 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-61-152.iad12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

Referer: https://login-page-security.webflow.io/
Origin: https://login-page-security.webflow.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 24 Jul 2024 20:08:11 GMT
content-encoding: br
via: 1.1 25d9b5959eaa82bb18ee3f35e6bf34b4.cloudfront.net (CloudFront)
age: 50253
x-amz-cf-pop: IAD12-P1
x-cache: Hit from cloudfront
last-modified: Mon, 20 Jul 2020 17:53:02 GMT
server: AmazonS3
etag: W/"dc5e7f18c8d36ac1d3d4753a87c98d0a"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
vary: Accept-Encoding
x-amz-cf-id: 3NAlLe_UXrz1TbMq7ZtjT2SvwWvXCURcJU1uTvI5aAeMh2zuVJUVfw==

GET
H2 200 webflow.4bdb9bf8f.js Show response
assets-global.website-files.com/65969fd4529344105db81549/js/ 45 KB
17 KB 556ms
222ms Script
text/javascript 2600:9000:2509:1000:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets-global.website-files.com/65969fd4529344105db81549/js/webflow.4bdb9bf8f.js
Requested by: Host: login-page-security.webflow.io
URL: https://login-page-security.webflow.io/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2509:1000:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 33ad552f672db7f6889f78609875828feb5a89b83f3294b48606386b63e54670

Request headers

Referer: https://login-page-security.webflow.io/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 25 Jul 2024 10:05:44 GMT
content-encoding: gzip
via: 1.1 3542174e2d71e2c3dffc0069aa7cbb34.cloudfront.net (CloudFront)
x-amz-version-id: I0MGWuC5oi1wArzd01oj4xpDJc3ieyvM
x-amz-cf-pop: IAD12-P2
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
content-length: 16826
last-modified: Thu, 04 Jan 2024 14:38:16 GMT
server: AmazonS3
etag: "29de6de4fa98e87d1da55f4a80e16506"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
accept-ranges: bytes
x-amz-cf-id: frG8ZQGnD9qbEe385rbPxA6IVvP4LhoXxpbtBekE0Q5UIfARd7KTkA==

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/Xv-KF0LlBu_a0FJ9I5YSlX5m/ 531 KB
211 KB 368ms
123ms Script
text/javascript 2607:f8b0:4004:c06::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/Xv-KF0LlBu_a0FJ9I5YSlX5m/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::5e Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e1d667d61bb50e0a815101a7d0d7f379b7219776fee856eedbe965a049db8d44

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://login-page-security.webflow.io/
Origin: https://login-page-security.webflow.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 25 Jul 2024 01:56:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29382
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 215075
x-xss-protection: 0
last-modified: Mon, 22 Jul 2024 21:52:36 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 25 Jul 2025 01:56:01 GMT

GET
H2 200 6596a03fb8b5e2db325223fe_Screenshot%202023-08-16%20at%2009-06-09%20Fibre%20Broadband%20TV%20Packages%20TNT%20Sports%20%26%20Mobile%20Deals%20BT-p-1600.png
assets-global.website-files.com/65969fd4529344105db81549/ 26 KB
27 KB 138ms
137ms Image
image/png 2600:9000:2509:1000:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/65969fd4529344105db81549/6596a03fb8b5e2db325223fe_Screenshot%202023-08-16%20at%2009-06-09%20Fibre%20Broadband%20TV%20Packages%20TNT%20Sports%20%26%20Mobile%20Deals%20BT-p-1600.png
Requested by: Host: login-page-security.webflow.io
URL: https://login-page-security.webflow.io/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2509:1000:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 430fff120920f40d91e4df91019e9e94c39e8a0e2a9520be923dd401248c1571

Request headers

Referer: https://login-page-security.webflow.io/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 20 Jul 2024 11:47:24 GMT
x-amz-version-id: 1YlqrgJKJVy3cB8Mch_sCEGn4dTYRoJa
via: 1.1 3542174e2d71e2c3dffc0069aa7cbb34.cloudfront.net (CloudFront)
age: 425900
x-amz-cf-pop: IAD12-P2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 26924
last-modified: Thu, 04 Jan 2024 12:10:43 GMT
server: AmazonS3
etag: "a337e190da6371bb5ddbc9e10cb464ed"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: 43RU7qNGezn3M4v1wa-UVx_vZQ8PJy1YayesZvhZ1TTHffpIZMGkQA==

GET
H2 200 6596a01d1550e5acc93178e2_Screenshot%202023-08-04%20at%2011-28-32%20Email%20Login%20Page-p-800.png
assets-global.website-files.com/65969fd4529344105db81549/ 120 KB
120 KB 268ms
267ms Image
image/png 2600:9000:2509:1000:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/65969fd4529344105db81549/6596a01d1550e5acc93178e2_Screenshot%202023-08-04%20at%2011-28-32%20Email%20Login%20Page-p-800.png
Requested by: Host: login-page-security.webflow.io
URL: https://login-page-security.webflow.io/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2509:1000:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 874c24ec3eaffd68417458d7c53f5660c281db5de8e32393cc31c98684c66f00

Request headers

Referer: https://login-page-security.webflow.io/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 20 Jul 2024 11:47:24 GMT
x-amz-version-id: HqieBzZMOdVWBg5HV98df17j9eHncLgK
via: 1.1 3542174e2d71e2c3dffc0069aa7cbb34.cloudfront.net (CloudFront)
age: 425900
x-amz-cf-pop: IAD12-P2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 122590
last-modified: Thu, 04 Jan 2024 12:10:13 GMT
server: AmazonS3
etag: "6533099d8e1abef3723b53e0c31a0699"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: u4N0ed_F3Zq_fSSjejv3TGtnssSdY_xijg9r-a6sGvAgzA5_0FAT0A==

GET
H2 200 6596a0046c09c411c2ff193e_Screenshot%202023-11-04%20at%2004-58-11%20Email%20Login%20Page-p-1600.png
assets-global.website-files.com/65969fd4529344105db81549/ 33 KB
34 KB 177ms
177ms Image
image/png 2600:9000:2509:1000:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/65969fd4529344105db81549/6596a0046c09c411c2ff193e_Screenshot%202023-11-04%20at%2004-58-11%20Email%20Login%20Page-p-1600.png
Requested by: Host: login-page-security.webflow.io
URL: https://login-page-security.webflow.io/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2509:1000:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 113e8eb51fcaaa31bd8c1fa4834f81cca1a0b75d70823c7c4702b715baec6b2f

Request headers

Referer: https://login-page-security.webflow.io/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 20 Jul 2024 11:47:24 GMT
x-amz-version-id: fNBgG6OoeDomnhKYOv5vCl9FKTHwX9wr
via: 1.1 3542174e2d71e2c3dffc0069aa7cbb34.cloudfront.net (CloudFront)
age: 425900
x-amz-cf-pop: IAD12-P2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 34000
last-modified: Thu, 04 Jan 2024 12:09:45 GMT
server: AmazonS3
etag: "a695937d7afc4b9bde5ad80dee45a26a"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: SoIRYZt1kWp2P1lv43XTAAAb_PaCN1Ka-ATlSe0yDvnWYHqNQLrx7g==

GET
H3 200 anchor
www.google.com/recaptcha/api2/ Frame AB2F 0
0 399ms
154ms Document
text/html 172.253.63.147
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LeWuUUpAAAAAMa425S053Lfrie2QNY1_xB2__t-&co=aHR0cHM6Ly9sb2dpbi1wYWdlLXNlY3VyaXR5LndlYmZsb3cuaW86NDQz&hl=en&v=Xv-KF0LlBu_a0FJ9I5YSlX5m&size=normal&cb=c777m0roobat

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/Xv-KF0LlBu_a0FJ9I5YSlX5m/recaptcha__en.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.147 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f147.1e100.net

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-AVmwv5ZZ1_--eM-6mjZB-A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://login-page-security.webflow.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-AVmwv5ZZ1_--eM-6mjZB-A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 25 Jul 2024 10:05:44 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 6596a2b6acdaf75d76a9886e_bt-logo.png
assets-global.website-files.com/65969fd4529344105db81549/ 3 KB
4 KB 121ms
119ms Other
image/png 2600:9000:2509:1000:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets-global.website-files.com/65969fd4529344105db81549/6596a2b6acdaf75d76a9886e_bt-logo.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2509:1000:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3c757cf35846742d586773f8146e88a5bc39308cf182ceb47686a407e0ebe1df

Request headers

Referer: https://login-page-security.webflow.io/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 20 Jul 2024 23:54:50 GMT
x-amz-version-id: M4G0azQqxA7GTGfi9Pfand.a5N5AM1oN
via: 1.1 3542174e2d71e2c3dffc0069aa7cbb34.cloudfront.net (CloudFront)
age: 382257
x-amz-cf-pop: IAD12-P2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 3322
last-modified: Thu, 04 Jan 2024 12:21:12 GMT
server: AmazonS3
etag: "7498ff0f7c189d07ee09b67597a07bf7"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: ix1nf-Kqse4mk8_uTn6JIv-jisOnWHu421-0UiRLGWgu1DZS5I0Gcw==

GET
H3 200 bframe
www.google.com/recaptcha/api2/ Frame 8D39 0
0 158ms
156ms Document
text/html 172.253.63.147
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=en&v=Xv-KF0LlBu_a0FJ9I5YSlX5m&k=6LeWuUUpAAAAAMa425S053Lfrie2QNY1_xB2__t-

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/Xv-KF0LlBu_a0FJ9I5YSlX5m/recaptcha__en.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.147 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f147.1e100.net

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-c_4eP9tDJdraGL39nGSg0A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://login-page-security.webflow.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-c_4eP9tDJdraGL39nGSg0A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 25 Jul 2024 10:05:46 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BT (Telecommunication)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://login-page-security.webflow.io/ Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self' https://.webflow.com http://.webflow.com http://*.webflow.io http://webflow.com https://webflow.com

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets-global.website-files.com
d3e54v103j8qbb.cloudfront.net
login-page-security.webflow.io
www.google.com
www.gstatic.com
108.138.61.152
151.101.2.188
172.253.63.147
2600:9000:2509:1000:12:9e5f:cac0:93a1
2607:f8b0:4004:c06::5e
113e8eb51fcaaa31bd8c1fa4834f81cca1a0b75d70823c7c4702b715baec6b2f
150ead8d6a6d8d083b396fde7911a8affb6be80b0ab984aec4b5ed5f5e023028
33ad552f672db7f6889f78609875828feb5a89b83f3294b48606386b63e54670
3c757cf35846742d586773f8146e88a5bc39308cf182ceb47686a407e0ebe1df
430fff120920f40d91e4df91019e9e94c39e8a0e2a9520be923dd401248c1571
874c24ec3eaffd68417458d7c53f5660c281db5de8e32393cc31c98684c66f00
a403618873287deb79fab03668c95d4b531e372dfff713af0d2825809734626c
e1d667d61bb50e0a815101a7d0d7f379b7219776fee856eedbe965a049db8d44
ea34d58b0a0b3d96855b53d94ed2aad2e0548ea33029f69d0eba0798329df187
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

login-page-security.webflow.io Open in urlscan Pro 151.101.2.188 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

12 Requests

100 %HTTPS

40 %IPv6

5 Domains

5 Subdomains

5 IPs

1 Countries

454 kBTransfer

890 kBSize

0 Cookies

0 Outgoing links

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

13 JavaScript Global Variables

0 Cookies

1 Console Messages

Security Headers

Indicators

login-page-security.webflow.io Open in urlscan Pro
151.101.2.188 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

5
IPs

1
Countries

454 kB
Transfer

890 kB
Size

0
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!