URL: https://login.mail-link365.sbs/
Submission: On September 04 via automatic, source certstream-suspicious — Scanned from NL

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 5 HTTP transactions. The main IP is 188.114.97.3, located in Amsterdam, Netherlands and belongs to CLOUDFLARENET, US. The main domain is login.mail-link365.sbs.
TLS certificate: Issued by WE1 on September 4th 2024. Valid for: 3 months.
This is the only time login.mail-link365.sbs was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 188.114.97.3 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
5 3
Apex Domain
Subdomains
Transfer
1 okta.com
www.okta.com — Cisco Umbrella Rank: 115034
18 KB
1 mail-link365.sbs
login.mail-link365.sbs
2 KB
0 youtube.com Failed
www.youtube.com Failed
5 3
Domain Requested by
1 www.okta.com
1 login.mail-link365.sbs
0 www.youtube.com Failed login.mail-link365.sbs
5 3

This site contains links to these domains. Also see Links.

Domain
support.okta.com
www.okta.com
developer.okta.com
Subject Issuer Validity Valid
mail-link365.sbs
WE1
2024-09-04 -
2024-12-03
3 months crt.sh
www.okta.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2024-07-30 -
2025-03-04
7 months crt.sh

This page contains 1 frames:

Primary Page: https://login.mail-link365.sbs/
Frame ID: 739EE6BF01B1211F6C0D63B387BB0441
Requests: 5 HTTP requests in this frame

Screenshot

Page Title

Log in to your Okta org

Page Statistics

5
Requests

40 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

20 kB
Transfer

24 kB
Size

4
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://login.mail-link365.sbs/css/okta-sign-in.css?17abdf702560067430e5 HTTP 302
  • https://www.youtube.com/watch?v=dQw4w9WgXcQ
Request Chain 1
  • https://login.mail-link365.sbs/lib/myOkta-17abdf702560067430e5.min.js HTTP 302
  • https://www.youtube.com/watch?v=dQw4w9WgXcQ
Request Chain 2
  • https://login.mail-link365.sbs/img/okta_logo.svg HTTP 302
  • https://www.youtube.com/watch?v=dQw4w9WgXcQ

5 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
login.mail-link365.sbs/
6 KB
2 KB
Document
General
Full URL
https://login.mail-link365.sbs/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9abe2e4ffca1156d723d485419e6524d3ebeefb9e5ee941e7703c864350591db

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

age
60516
alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8bdfa420cf6d6652-AMS
content-encoding
br
content-type
text/html
date
Wed, 04 Sep 2024 17:18:51 GMT
last-modified
Thu, 29 Aug 2024 22:15:29 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Pus42yvM2dCNiVPO1sylL6Px989H4wilJB3DDB2TCKG2HwEUcB8jCmLOpw4IWmiHeflTCnk5Sf2qI9PxJbjOi31miC3BpeskdtsQCK4gw7EAYMRKq9DFT5muEpju42llDb7AiHz1eIU5"}],"group":"cf-nel","max_age":604800}
server
cloudflare
via
1.1 f13110b40e6214ad566c753a838f49f4.cloudfront.net (CloudFront)
x-amz-cf-id
LAs0TYoqeXR8c7M6Jb4quJ0ul721mLLtYqZestliQTwp7Fpzp-U1Zw==
x-amz-cf-pop
FRA56-P6
x-cache
Hit from cloudfront
watch
www.youtube.com/
Redirect Chain
  • https://login.mail-link365.sbs/css/okta-sign-in.css?17abdf702560067430e5
  • https://www.youtube.com/watch?v=dQw4w9WgXcQ
0
0

watch
www.youtube.com/
Redirect Chain
  • https://login.mail-link365.sbs/lib/myOkta-17abdf702560067430e5.min.js
  • https://www.youtube.com/watch?v=dQw4w9WgXcQ
0
0

watch
www.youtube.com/
Redirect Chain
  • https://login.mail-link365.sbs/img/okta_logo.svg
  • https://www.youtube.com/watch?v=dQw4w9WgXcQ
0
0

favicon.ico
www.okta.com/sites/default/files/
18 KB
18 KB
Other
General
Full URL
https://www.okta.com/sites/default/files/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:d469 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f9751d4de92778a206d2b43222ef879dbd8f60fa82395269c58c1ec2c28bd134

Request headers

Referer
https://login.mail-link365.sbs/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-cache-hits
0, 0
date
Wed, 04 Sep 2024 17:18:51 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
expires
Fri, 05 Sep 2025 17:18:51 GMT
cf-cache-status
HIT
age
11305445
x-cache
HIT, HIT
content-length
17764
x-served-by
cache-chi-klot8100092-CHI, cache-ams21047-AMS
last-modified
Tue, 08 Nov 2022 02:04:56 GMT
server
cloudflare
x-timer
S1714164886.203755,VS0,VE3
etag
"6369b948-4606"
vary
Accept-Encoding
content-type
image/x-icon
x-styx-req-id
5d1d32ab-f371-11ee-8d71-0efe9f8bec5f
cache-control
public, max-age=31622400
accept-ranges
bytes
cf-ray
8bdfa4237c0365f4-AMS
x-pantheon-styx-hostname
styx-fe2-a-55458cf9d7-8xnzb

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
www.youtube.com
URL
https://www.youtube.com/watch?v=dQw4w9WgXcQ
Domain
www.youtube.com
URL
https://www.youtube.com/watch?v=dQw4w9WgXcQ
Domain
www.youtube.com
URL
https://www.youtube.com/watch?v=dQw4w9WgXcQ

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Domain/Path Name / Value
.youtube.com/ Name: YSC
Value: r5eWAoEUKO0
.youtube.com/ Name: VISITOR_PRIVACY_METADATA
Value: CgJOTBIcEhgSFhMLFBUWFwwYGRobHB0eHw4PIBAREiEgNA%3D%3D
.okta.com/ Name: __cf_bm
Value: 8zyQtzGmegN5CJ8v1x3TQ3KbwMxuL1qIM0NbqvIsWpg-1725470331-1.0.1.1-kkqOhQFSaPq3EVP12LrA5ZGoc_4zb2pV85x9YIHDDsH_dOJ6BrBVP2LGmptlqqABzdfI5JLi.d1b4vldm8boTg
.okta.com/ Name: _cfuvid
Value: rvkgO00tiqULEmi3UEveSKrP7NHhS3dqtbvaZ0V474Q-1725470331468-0.0.1.1-604800000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

login.mail-link365.sbs
www.okta.com
www.youtube.com
www.youtube.com
188.114.97.3
2606:4700::6812:d469
9abe2e4ffca1156d723d485419e6524d3ebeefb9e5ee941e7703c864350591db
f9751d4de92778a206d2b43222ef879dbd8f60fa82395269c58c1ec2c28bd134