broadband-52dbbd.webflow.io
Open in
urlscan Pro
151.101.194.188
Malicious Activity!
Public Scan
Submission: On August 17 via automatic, source phishtank — Scanned from CA
Summary
TLS certificate: Issued by GlobalSign Atlas R3 DV TLS CA 2023 Q4 on November 29th 2023. Valid for: a year.
This is the only time broadband-52dbbd.webflow.io was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: BT (Telecommunication)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 151.101.194.188 151.101.194.188 | 54113 (FASTLY) (FASTLY) | |
6 | 2600:9000:266... 2600:9000:266a:5000:12:9e5f:cac0:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
3 | 142.250.72.100 142.250.72.100 | 15169 (GOOGLE) (GOOGLE) | |
1 | 18.238.59.58 18.238.59.58 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2607:f8b0:400... 2607:f8b0:4006:80e::2003 | 15169 (GOOGLE) (GOOGLE) | |
12 | 5 |
ASN16509 (AMAZON-02, US)
assets-global.website-files.com |
ASN15169 (GOOGLE, US)
PTR: lga34s32-in-f4.1e100.net
www.google.com |
ASN16509 (AMAZON-02, US)
PTR: server-18-238-59-58.jfk52.r.cloudfront.net
d3e54v103j8qbb.cloudfront.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
website-files.com
assets-global.website-files.com — Cisco Umbrella Rank: 33607 |
164 KB |
3 |
google.com
www.google.com — Cisco Umbrella Rank: 10 |
962 B |
1 |
gstatic.com
www.gstatic.com |
210 KB |
1 |
cloudfront.net
d3e54v103j8qbb.cloudfront.net |
32 KB |
1 |
webflow.io
broadband-52dbbd.webflow.io |
2 KB |
12 | 5 |
Domain | Requested by | |
---|---|---|
6 | assets-global.website-files.com |
broadband-52dbbd.webflow.io
|
3 | www.google.com |
broadband-52dbbd.webflow.io
www.gstatic.com |
1 | www.gstatic.com |
www.google.com
|
1 | d3e54v103j8qbb.cloudfront.net |
broadband-52dbbd.webflow.io
|
1 | broadband-52dbbd.webflow.io | |
12 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.webflow.io GlobalSign Atlas R3 DV TLS CA 2023 Q4 |
2023-11-29 - 2024-12-30 |
a year | crt.sh |
*.website-files.com Amazon RSA 2048 M02 |
2024-08-10 - 2025-09-07 |
a year | crt.sh |
*.google.com WR2 |
2024-07-30 - 2024-10-22 |
3 months | crt.sh |
*.cloudfront.net Amazon RSA 2048 M01 |
2024-07-30 - 2025-07-03 |
a year | crt.sh |
*.gstatic.com WR2 |
2024-07-30 - 2024-10-22 |
3 months | crt.sh |
This page contains 3 frames:
Primary Page:
https://broadband-52dbbd.webflow.io/
Frame ID: BEB5F65EFAC9987692C4E04C25060329
Requests: 10 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lew6kYpAAAAAP5g8vqbKHbLstkkMmmc5elmtRij&co=aHR0cHM6Ly9icm9hZGJhbmQtNTJkYmJkLndlYmZsb3cuaW86NDQz&hl=en&v=hfUfsXWZFeg83qqxrK27GB8P&size=normal&cb=5kkhfzjlummk
Frame ID: 58D8045A49BB96506C6E6D370CFF784A
Requests: 1 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/api2/bframe?hl=en&v=hfUfsXWZFeg83qqxrK27GB8P&k=6Lew6kYpAAAAAP5g8vqbKHbLstkkMmmc5elmtRij
Frame ID: 9CE3478E84D5AD8386764808DD84D584
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
BroadbandDetected technologies
jQuery (JavaScript Libraries) ExpandDetected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
reCAPTCHA (Captchas) Expand
Detected patterns
- /recaptcha/api\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
broadband-52dbbd.webflow.io/ |
6 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
broadband-52dbbd.webflow.ce8f21d51.css
assets-global.website-files.com/6597cc7a635a4186d07f56fa/css/ |
36 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
api.js
www.google.com/recaptcha/ |
1 KB 962 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.5.1.min.dc5e7f18c8.js
d3e54v103j8qbb.cloudfront.net/js/ |
87 KB 32 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
webflow.4bdb9bf8f.js
assets-global.website-files.com/6597cc7a635a4186d07f56fa/js/ |
45 KB 17 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
recaptcha__en.js
www.gstatic.com/recaptcha/releases/hfUfsXWZFeg83qqxrK27GB8P/ |
531 KB 210 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6597cde3a01e421b28697648_Screenshot%202023-08-16%20at%2009-06-09%20Fibre%20Broadband%20TV%20Packages%20TNT%20Sports%20%26%20Mobile%20Deals%20BT-p-1600.png
assets-global.website-files.com/6597cc7a635a4186d07f56fa/ |
26 KB 27 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6597cde44e1e0284aa3695ca_Screenshot%202023-11-04%20at%2004-59-24%20Email%20Login%20Page-p-800.png
assets-global.website-files.com/6597cc7a635a4186d07f56fa/ |
74 KB 74 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6597cde3563b39de25be653d_Screenshot%202023-11-04%20at%2004-58-11%20Email%20Login%20Page-p-1600.png
assets-global.website-files.com/6597cc7a635a4186d07f56fa/ |
33 KB 34 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
anchor
www.google.com/recaptcha/api2/ Frame 58D8 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6597d071507f8e07fe512c4d_bt-logo.png
assets-global.website-files.com/6597cc7a635a4186d07f56fa/ |
3 KB 4 KB |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bframe
www.google.com/recaptcha/api2/ Frame 9CE3 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: BT (Telecommunication)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| 2 object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client function| $ function| jQuery function| tram object| Webflow object| recaptcha object| closure_lm_7122330 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | frame-ancestors 'self' https://*.webflow.com http://*.webflow.com http://*.webflow.io http://webflow.com https://webflow.com |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
assets-global.website-files.com
broadband-52dbbd.webflow.io
d3e54v103j8qbb.cloudfront.net
www.google.com
www.gstatic.com
142.250.72.100
151.101.194.188
18.238.59.58
2600:9000:266a:5000:12:9e5f:cac0:93a1
2607:f8b0:4006:80e::2003
09ac8d9a076e3c66bb4ad9da621954214ce4d0faebdd6f621dac99503db4ded2
113e8eb51fcaaa31bd8c1fa4834f81cca1a0b75d70823c7c4702b715baec6b2f
150ead8d6a6d8d083b396fde7911a8affb6be80b0ab984aec4b5ed5f5e023028
33ad552f672db7f6889f78609875828feb5a89b83f3294b48606386b63e54670
3c757cf35846742d586773f8146e88a5bc39308cf182ceb47686a407e0ebe1df
430fff120920f40d91e4df91019e9e94c39e8a0e2a9520be923dd401248c1571
618a7651d400c72397a36e86d168ed7df8a78f6d7058e7274f5e7157442ce8fe
70925c4bda48e2ae325950aab67fe70a75dc2984b9e4f5844f4858c5adf6ef2b
e96a5e1e04ee3d7ffd8118f853ec2c0bcbf73b571cfa1c710238557baf5dd896
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d