number-two-8c2b6.web.app
Open in
urlscan Pro
199.36.158.100
Malicious Activity!
Public Scan
Effective URL: https://number-two-8c2b6.web.app/login.html
Submission: On June 20 via api from JP — Scanned from JP
Summary
TLS certificate: Issued by GTS CA 1D4 on May 10th 2023. Valid for: 3 months.
This is the only time number-two-8c2b6.web.app was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: BT (Telecommunication)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
4 | 199.36.158.100 199.36.158.100 | 54113 (FASTLY) (FASTLY) | |
1 | 104.18.22.52 104.18.22.52 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 142.250.198.10 142.250.198.10 | 15169 (GOOGLE) (GOOGLE) | |
1 | 151.101.65.229 151.101.65.229 | 54113 (FASTLY) (FASTLY) | |
1 | 111.119.26.136 111.119.26.136 | 22822 (LLNW) (LLNW) | |
9 | 6 |
ASN15169 (GOOGLE, US)
PTR: nrt12s58-in-f10.1e100.net
ajax.googleapis.com |
ASN22822 (LLNW, US)
PTR: https-111-119-26-136.nrt.llnw.net
img01.bt.co.uk |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
web.app
number-two-8c2b6.web.app |
4 KB |
1 |
bt.co.uk
img01.bt.co.uk — Cisco Umbrella Rank: 167945 |
989 B |
1 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 379 |
4 KB |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 422 |
30 KB |
1 |
fontawesome.com
pro.fontawesome.com — Cisco Umbrella Rank: 7176 |
29 KB |
0 |
ipify.org
Failed
api.ipify.org Failed |
|
9 | 6 |
Domain | Requested by | |
---|---|---|
4 | number-two-8c2b6.web.app |
number-two-8c2b6.web.app
|
1 | img01.bt.co.uk |
number-two-8c2b6.web.app
|
1 | cdn.jsdelivr.net |
number-two-8c2b6.web.app
|
1 | ajax.googleapis.com |
number-two-8c2b6.web.app
|
1 | pro.fontawesome.com |
number-two-8c2b6.web.app
|
0 | api.ipify.org Failed |
ajax.googleapis.com
|
9 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
web.app GTS CA 1D4 |
2023-05-10 - 2023-08-08 |
3 months | crt.sh |
*.fontawesome.com DigiCert TLS RSA SHA256 2020 CA1 |
2022-11-22 - 2023-12-23 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-05-22 - 2023-08-14 |
3 months | crt.sh |
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2022 Q4 |
2022-12-23 - 2024-01-24 |
a year | crt.sh |
www.bt.com GeoTrust EV RSA CA 2018 |
2022-09-02 - 2023-09-20 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://number-two-8c2b6.web.app/login.html
Frame ID: C7505F28CE6C67F4E74D44B3C340024E
Requests: 9 HTTP requests in this frame
Screenshot
Page Title
Email Login PagePage URL History Show full URLs
- https://number-two-8c2b6.web.app/ Page URL
- https://number-two-8c2b6.web.app/login.html Page URL
Detected technologies
Font Awesome (Font Scripts) ExpandDetected patterns
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jsDelivr (CDN) Expand
Detected patterns
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://number-two-8c2b6.web.app/ Page URL
- https://number-two-8c2b6.web.app/login.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
number-two-8c2b6.web.app/ |
270 B 470 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
login.html
number-two-8c2b6.web.app/ |
8 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.css
pro.fontawesome.com/releases/v5.10.0/css/ |
153 KB 29 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
form.css
number-two-8c2b6.web.app/css/ |
1 KB 435 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
number-two-8c2b6.web.app/css/ |
4 KB 902 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.2.1/ |
85 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
email.min.js
cdn.jsdelivr.net/npm/emailjs-com@2.4.0/dist/ |
9 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo-2018.svg
img01.bt.co.uk/s/assets/210322/images/logo/ |
1 KB 989 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
/
api.ipify.org/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- api.ipify.org
- URL
- https://api.ipify.org/?format=json
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: BT (Telecommunication)12 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| onbeforetoggle object| onscrollend function| $ function| jQuery object| emailjs function| getParameterByName object| foo undefined| xxip function| sendmail function| processForm object| form0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31556926; includeSubDomains; preload |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
api.ipify.org
cdn.jsdelivr.net
img01.bt.co.uk
number-two-8c2b6.web.app
pro.fontawesome.com
api.ipify.org
104.18.22.52
111.119.26.136
142.250.198.10
151.101.65.229
199.36.158.100
07e9d4d6a617d90407a0041a950912ba8f85bcb61be41deec67fc95aa16062a1
0ac22253bc82b412c1b38caae393b2a375a2998b1f55b493b94e4ee1f70762d0
2af905d92cfd34b5413126a54f639da408166cbbcb54318e413ad5e10b5bf6ec
2d50a053ddffb7c179a3ca3576bd1ae15223d406ee5aedce1968dc28068aa781
31477df74595ceef14342e7bb7765d03ed5e2cadcab11d03cd520ea4ca4508d8
3a97ee3018549e6216edf798373d49b4eaeb07d24fa5dd7e8f8f34063ad79b3f
66e0dcbe426bc176cc398548ebdbb5c3c922c1b4f58d6559a9718101480ad290
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de