fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com Open in urlscan Pro
198.199.109.95 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://bit.do/Optus-Bill
Effective URL:
https://fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com/apytgfjdggjf/fdhjkkuyg/
Submission Tags: 7463364
Submission: On March 14 via api (March 14th 2022, 2:26:46 am UTC) from US — Scanned from DE

Summary HTTP 11 Redirects Links 6 Behaviour Indicators

Summary

This website contacted 6 IPs in 2 countries across 5 domains to perform 11 HTTP transactions. The main IP is 198.199.109.95, located in San Francisco, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on August 20th 2021. Valid for: a year.

This is the only time fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Optus (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
1 1	54.83.52.76 54.83.52.76	14618 (AMAZON-AES) (AMAZON-AES)
1	203.175.8.27 203.175.8.27	58487 (RUMAHWEB-...) (RUMAHWEB-AS-ID Rumahweb Indonesia CV.)
1	151.101.0.64 151.101.0.64	54113 (FASTLY) (FASTLY)
2	198.199.109.95 198.199.109.95	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
3	18.64.79.36 18.64.79.36	16509 (AMAZON-02) (AMAZON-02)
4	18.66.248.21 18.66.248.21	16509 (AMAZON-02) (AMAZON-02)
11	6

1 54.83.52.76 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-83-52-76.compute-1.amazonaws.com

bit.do	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 203.175.8.27 (Indonesia)

ASN58487 (RUMAHWEB-AS-ID Rumahweb Indonesia CV., ID)
PTR: subadra.satu.rumahweb.com

yasin-alsys.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.0.64 (United States)

ASN54113 (FASTLY, US)

disq.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 198.199.109.95 (San Francisco, United States)

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: codeanyproxy.com

fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 18.64.79.36 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-64-79-36.txl50.r.cloudfront.net

cdn.optusdigital.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 18.66.248.21 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-248-21.dus51.r.cloudfront.net

1.cdn.optusdigital.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	optusdigital.com cdn.optusdigital.com — Cisco Umbrella Rank: 988537 1.cdn.optusdigital.com	434 KB
2	codeanyapp.com fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com	16 KB
1	disq.us disq.us — Cisco Umbrella Rank: 19814	799 B
1	yasin-alsys.org yasin-alsys.org	262 B
1	bit.do 1 redirects bit.do — Cisco Umbrella Rank: 153119	124 B
11	5

	Domain	Requested by
4	1.cdn.optusdigital.com	fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com
3	cdn.optusdigital.com	fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com cdn.optusdigital.com
2	fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com	disq.us fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com
1	disq.us
1	yasin-alsys.org
1	bit.do	1 redirects
11	6

This site contains links to these domains. Also see Links.

Domain
www.optus.com.au
www.singtel.com
go.microsoft.com
www.bing.com

Subject Issuer	Validity	Valid
*.yasin-alsys.org R3	`2022-01-27` - `2022-04-27`	3 months	crt.sh
disq.us GlobalSign Atlas R3 DV TLS CA 2022 Q1	`2022-01-28` - `2023-03-01`	a year	crt.sh
*.codeanyapp.com Sectigo RSA Domain Validation Secure Server CA	`2021-08-20` - `2022-08-20`	a year	crt.sh
cdn.optusdigital.com Amazon	`2021-11-08` - `2022-12-06`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com/apytgfjdggjf/fdhjkkuyg/
Frame ID: 4886AC342EC89736D9C888E28D2DCF11
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

My Account Login - Optus

Page URL History Show full URLs

https://bit.do/Optus-Bill HTTP 301
https://yasin-alsys.org/wp-admin/js/css/index9.html Page URL
https://disq.us/?url=https%3A%2F%2Ffdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com%2Fapytgfj... Page URL
https://fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com/apytgfjdggjf/fdhjkkuyg/ Page URL

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

/etc/designs/

Page Statistics

11
Requests

100 %
HTTPS

0 %
IPv6

5
Domains

6
Subdomains

6
IPs

2
Countries

452 kB
Transfer

1001 kB
Size

0
Cookies

6 Outgoing links

These are links going to different origins than the main page.

URL: https://www.optus.com.au/shop/stores
Title: Store Locator

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/for-you/support/contact-us
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://www.singtel.com/about-us
Title: About Singtel

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/for-you/support/feedback-and-complaints?sid=complaints:source:homepage
Title: Feedback & Complaints

Search URL Search Domain Scan URL

URL: https://go.microsoft.com/?linkid=9722454

Search URL Search Domain Scan URL

URL: http://www.bing.com/widget/translator
Title: Bing Webmaster Portal

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://bit.do/Optus-Bill HTTP 301
https://yasin-alsys.org/wp-admin/js/css/index9.html Page URL
https://disq.us/?url=https%3A%2F%2Ffdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com%2Fapytgfjdggjf%2Ffdhjkkuyg%2F&key=qmMHzirJjXEoSPAA_4vqlA Page URL
https://fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com/apytgfjdggjf/fdhjkkuyg/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://bit.do/Optus-Bill HTTP 301
https://yasin-alsys.org/wp-admin/js/css/index9.html

11 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

index9.html
yasin-alsys.org/wp-admin/js/css/
Redirect Chain

https://bit.do/Optus-Bill
https://yasin-alsys.org/wp-admin/js/css/index9.html

187 B
262 B

1679ms
204ms

Document
text/html

203.175.8.27
RUMAHWEB-AS-ID Ru...

General

Check archive.org

Show headers Download Go to

Full URL: https://yasin-alsys.org/wp-admin/js/css/index9.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 203.175.8.27 , Indonesia, ASN58487 (RUMAHWEB-AS-ID Rumahweb Indonesia CV., ID),
Reverse DNS: subadra.satu.rumahweb.com
Software: Apache /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

last-modified: Fri, 11 Mar 2022 04:04:19 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: br
content-length: 147
content-type: text/html
date: Mon, 14 Mar 2022 02:26:39 GMT
server: Apache

Redirect headers

server: nginx/1.18.0
date: Mon, 14 Mar 2022 02:26:37 GMT
content-type: text/html; charset=iso-8859-1
content-length: 331
location: https://yasin-alsys.org/wp-admin/js/css/index9.html

GET
H/1.1 200
OK /
disq.us/ 406 B
799 B 47ms
8ms Document
text/html 151.101.0.64
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disq.us/?url=https%3A%2F%2Ffdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com%2Fapytgfjdggjf%2Ffdhjkkuyg%2F&key=qmMHzirJjXEoSPAA_4vqlA

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.0.64 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://yasin-alsys.org/

Response headers

Connection: keep-alive
Content-Length: 406
Server: nginx
Content-Type: text/html
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Expires: Mon, 14 Mar 2022 03:25:39 GMT
Cache-Control: max-age=3600
X-Backend: shortener
Disqus-Cachetype: TTL
Disqus-NoCache: 1
Date: Mon, 14 Mar 2022 02:26:39 GMT
Age: 60
Cross-Origin-Resource-Policy: cross-origin

GET
H2 200 Primary Request / Show response
fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com/apytgfjdggjf/fdhjkkuyg/ 118 KB
16 KB 1044ms
709ms Document
text/html 198.199.109.95
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com/apytgfjdggjf/fdhjkkuyg/
Requested by: Host: disq.us
URL: https://disq.us/?url=https%3A%2F%2Ffdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com%2Fapytgfjdggjf%2Ffdhjkkuyg%2F&key=qmMHzirJjXEoSPAA_4vqlA
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 198.199.109.95 San Francisco, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: codeanyproxy.com
Software: openresty/1.13.6.2 /
Resource Hash: 26f2c5fcd8ef54cbaaf08c459eb34a2b4636f836de638253475754879c061af8

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://disq.us/

Response headers

server: openresty/1.13.6.2
date: Mon, 14 Mar 2022 02:21:46 GMT
content-type: text/html; charset=UTF-8
content-length: 16455
vary: Accept-Encoding
content-encoding: gzip

GET
H2 200 lux.base.50b3d4d3488ad779a49fcece0f6c4d06.css
cdn.optusdigital.com/etc/designs/springd/clientlibs/osg/ 499 KB
49 KB 123ms
47ms Stylesheet
text/css 18.64.79.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.optusdigital.com/etc/designs/springd/clientlibs/osg/lux.base.50b3d4d3488ad779a49fcece0f6c4d06.css
Requested by: Host: fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com
URL: https://fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com/apytgfjdggjf/fdhjkkuyg/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.79.36 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-79-36.txl50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 960cb8583a7b2a787da1670e1ce1658fdb8c45a21b4e40a2788936b272256828

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 14 Mar 2022 02:26:40 GMT
content-encoding: gzip
last-modified: Wed, 16 Feb 2022 01:35:39 GMT
server: AmazonS3
age: 81
etag: W/"50b3d4d3488ad779a49fcece0f6c4d06"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
via: 1.1 56d45ca72c110eb4c3736727b5f5040a.cloudfront.net (CloudFront)
x-amz-cf-pop: TXL50-P2
x-amz-cf-id: rQTJRfSn85ytcsv4Ey0EWdMOY2cg5dBg7SVuoDzL_A7hDSpoyy2clA==

GET
H2 200 markpro-bold.woff
1.cdn.optusdigital.com/LUX2/assets/fonts/ 66 KB
67 KB 259ms
24ms Font
binary/octet-stream 18.66.248.21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://1.cdn.optusdigital.com/LUX2/assets/fonts/markpro-bold.woff
Requested by: Host: fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com
URL: https://fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com/apytgfjdggjf/fdhjkkuyg/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.248.21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-248-21.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06e6ac46fef95be90de802cbf8f07aefa9d2c9416ea8e32bccef5d526bb96e5f

Request headers

Referer: https://fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com/
Origin: https://fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 14 Mar 2022 00:45:32 GMT
via: 1.1 1b18b0df6149933160ee945c6867dc2c.cloudfront.net (CloudFront)
age: 6070
x-cache: Hit from cloudfront
content-length: 67824
last-modified: Thu, 10 Jun 2021 23:48:31 GMT
server: AmazonS3
etag: "507b76aa0351c57ece90f02239b62ba3"
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: binary/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000
x-amz-cf-pop: DUS51-P1
accept-ranges: bytes
x-amz-cf-id: 5klhIHwuiicUjN9Is4by4rmn5rH69BsyP8GJBqPefiECXlAzNXBVJQ==

GET
H2 200 markpro-heavy.woff
1.cdn.optusdigital.com/LUX2/assets/fonts/ 66 KB
67 KB 272ms
37ms Font
binary/octet-stream 18.66.248.21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://1.cdn.optusdigital.com/LUX2/assets/fonts/markpro-heavy.woff
Requested by: Host: fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com
URL: https://fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com/apytgfjdggjf/fdhjkkuyg/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.248.21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-248-21.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4447d75f8502cc1989762d2281eb12cf991055b71f94215ad2b3d6aca6295ab7

Request headers

Referer: https://fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com/
Origin: https://fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 14 Mar 2022 00:45:32 GMT
via: 1.1 1b18b0df6149933160ee945c6867dc2c.cloudfront.net (CloudFront)
age: 6070
x-cache: Hit from cloudfront
content-length: 67808
last-modified: Thu, 10 Jun 2021 23:48:34 GMT
server: AmazonS3
etag: "b7b268c962e2855acf62186c96a55466"
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: binary/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000
x-amz-cf-pop: DUS51-P1
accept-ranges: bytes
x-amz-cf-id: HWo3FZ_N8SJy7TwtFAYNThQvst8gmkUcMtj69mEBGEnX4BIFvLVAAQ==

GET
H2 200 markpro-medium.woff
1.cdn.optusdigital.com/LUX2/assets/fonts/ 62 KB
63 KB 267ms
32ms Font
binary/octet-stream 18.66.248.21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://1.cdn.optusdigital.com/LUX2/assets/fonts/markpro-medium.woff
Requested by: Host: fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com
URL: https://fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com/apytgfjdggjf/fdhjkkuyg/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.248.21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-248-21.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5576c66b220ae8ee5288c5483174ab06ce19583f41dce09f3ee836f7a24e7bc9

Request headers

Referer: https://fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com/
Origin: https://fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 11 Mar 2022 06:04:55 GMT
via: 1.1 1b18b0df6149933160ee945c6867dc2c.cloudfront.net (CloudFront)
age: 246107
x-cache: Hit from cloudfront
content-length: 63644
last-modified: Thu, 10 Jun 2021 23:48:37 GMT
server: AmazonS3
etag: "e8d148d9b31626f122da0039b97cbdf5"
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: binary/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000
x-amz-cf-pop: DUS51-P1
accept-ranges: bytes
x-amz-cf-id: 66b_F4RNkuYtOXeigXf-MZUOOXF526ruwyKw4fhewTADWSvEoxZ0fg==

GET
H2 200 markpro.woff
1.cdn.optusdigital.com/LUX2/assets/fonts/ 65 KB
66 KB 247ms
13ms Font
binary/octet-stream 18.66.248.21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://1.cdn.optusdigital.com/LUX2/assets/fonts/markpro.woff
Requested by: Host: fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com
URL: https://fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com/apytgfjdggjf/fdhjkkuyg/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.248.21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-248-21.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7b1443ccd9f5702ad832d5f8f58cd7955da80b6be466208e37900863097dbb12

Request headers

Referer: https://fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com/
Origin: https://fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 11 Mar 2022 04:16:50 GMT
via: 1.1 1b18b0df6149933160ee945c6867dc2c.cloudfront.net (CloudFront)
age: 252592
x-cache: Hit from cloudfront
content-length: 66552
last-modified: Thu, 10 Jun 2021 23:48:43 GMT
server: AmazonS3
etag: "ee10f7196c1b125a3b8222341465bf5e"
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: binary/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000
x-amz-cf-pop: DUS51-P1
accept-ranges: bytes
x-amz-cf-id: M_YSdjF00OAM7xXNNDLG8ihKUabAp1dwV-x4e69OxyseVeVOFiBjbQ==

GET
H2 404 lux.865b8f6d73733e01f46049f4d7740f0a.css
fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com/etc/designs/springd/clientlibs/page-bundle/content/optus/en/my-account-login/ 0
0 284ms
284ms Stylesheet
text/html 198.199.109.95
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com/etc/designs/springd/clientlibs/page-bundle/content/optus/en/my-account-login/lux.865b8f6d73733e01f46049f4d7740f0a.css
Requested by: Host: fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com
URL: https://fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com/apytgfjdggjf/fdhjkkuyg/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 198.199.109.95 San Francisco, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: codeanyproxy.com
Software: openresty/1.13.6.2 /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com/apytgfjdggjf/fdhjkkuyg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 14 Mar 2022 02:21:46 GMT
server: openresty/1.13.6.2
content-length: 429
content-type: text/html; charset=iso-8859-1

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: eea41981c12ea68bbb642bc6fccdcfce8ce0c6ac21f998c6621a486db6f8e004

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 ee10f7196c1b125a3b8222341465bf5e.woff
cdn.optusdigital.com/etc/designs/springd/clientlibs/osg/assets/fonts/markpro/ 65 KB
65 KB 109ms
68ms Font
binary/octet-stream 18.64.79.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.optusdigital.com/etc/designs/springd/clientlibs/osg/assets/fonts/markpro/ee10f7196c1b125a3b8222341465bf5e.woff
Requested by: Host: cdn.optusdigital.com
URL: https://cdn.optusdigital.com/etc/designs/springd/clientlibs/osg/lux.base.50b3d4d3488ad779a49fcece0f6c4d06.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.79.36 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-79-36.txl50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7b1443ccd9f5702ad832d5f8f58cd7955da80b6be466208e37900863097dbb12

Request headers

Referer: https://cdn.optusdigital.com/etc/designs/springd/clientlibs/osg/lux.base.50b3d4d3488ad779a49fcece0f6c4d06.css
Origin: https://fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 14 Mar 2022 00:45:33 GMT
via: 1.1 0cd2c3fbaf7659321a893cd5ab933aa4.cloudfront.net (CloudFront)
last-modified: Wed, 02 Mar 2022 01:40:04 GMT
server: AmazonS3
age: 6068
etag: "ee10f7196c1b125a3b8222341465bf5e"
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: binary/octet-stream
access-control-allow-origin: *
x-cache: Hit from cloudfront
x-amz-cf-pop: TXL50-P2
accept-ranges: bytes
content-length: 66552
x-amz-cf-id: ncJL6a3X4NpOE9H05Lnbz8W7olncb8hLOOPPCJS6KLie8y-h4iDFfA==

GET
H2 200 57d7b446c53b36cb99656354d6cbd2b7.woff
cdn.optusdigital.com/etc/designs/springd/clientlibs/osg/assets/fonts/lux-icons/ 58 KB
58 KB 86ms
46ms Font
binary/octet-stream 18.64.79.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.optusdigital.com/etc/designs/springd/clientlibs/osg/assets/fonts/lux-icons/57d7b446c53b36cb99656354d6cbd2b7.woff
Requested by: Host: cdn.optusdigital.com
URL: https://cdn.optusdigital.com/etc/designs/springd/clientlibs/osg/lux.base.50b3d4d3488ad779a49fcece0f6c4d06.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.79.36 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-79-36.txl50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 535547b941c74c7aa5b0b6c7c03737140521e3fd33aeeb717663b02bdb217bd7

Request headers

Referer: https://cdn.optusdigital.com/etc/designs/springd/clientlibs/osg/lux.base.50b3d4d3488ad779a49fcece0f6c4d06.css
Origin: https://fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 14 Mar 2022 00:45:33 GMT
via: 1.1 0cd2c3fbaf7659321a893cd5ab933aa4.cloudfront.net (CloudFront)
last-modified: Wed, 16 Feb 2022 01:35:28 GMT
server: AmazonS3
age: 6068
etag: "57d7b446c53b36cb99656354d6cbd2b7"
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: binary/octet-stream
access-control-allow-origin: *
x-cache: Hit from cloudfront
x-amz-cf-pop: TXL50-P2
accept-ranges: bytes
content-length: 58916
x-amz-cf-id: pL6-bg5K_XxIJUwEfjk_sT42ilfwMflwupdlSBNqB7_FymQKIWY2Xw==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Optus (Telecommunication)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com/etc/designs/springd/clientlibs/page-bundle/content/optus/en/my-account-login/lux.865b8f6d73733e01f46049f4d7740f0a.css Message: Failed to load resource: the server responded with a status of 404 ()
javascript	warning	URL: https://fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com/apytgfjdggjf/fdhjkkuyg/ Message: The resource https://1.cdn.optusdigital.com/LUX2/assets/fonts/markpro-medium.woff was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com/apytgfjdggjf/fdhjkkuyg/ Message: The resource https://1.cdn.optusdigital.com/LUX2/assets/fonts/markpro.woff was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1.cdn.optusdigital.com
bit.do
cdn.optusdigital.com
disq.us
fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com
yasin-alsys.org
151.101.0.64
18.64.79.36
18.66.248.21
198.199.109.95
203.175.8.27
54.83.52.76
06e6ac46fef95be90de802cbf8f07aefa9d2c9416ea8e32bccef5d526bb96e5f
26f2c5fcd8ef54cbaaf08c459eb34a2b4636f836de638253475754879c061af8
4447d75f8502cc1989762d2281eb12cf991055b71f94215ad2b3d6aca6295ab7
535547b941c74c7aa5b0b6c7c03737140521e3fd33aeeb717663b02bdb217bd7
5576c66b220ae8ee5288c5483174ab06ce19583f41dce09f3ee836f7a24e7bc9
7b1443ccd9f5702ad832d5f8f58cd7955da80b6be466208e37900863097dbb12
960cb8583a7b2a787da1670e1ce1658fdb8c45a21b4e40a2788936b272256828
eea41981c12ea68bbb642bc6fccdcfce8ce0c6ac21f998c6621a486db6f8e004

fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com Open in urlscan Pro 198.199.109.95 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

0 %IPv6

5 Domains

6 Subdomains

6 IPs

2 Countries

452 kBTransfer

1001 kBSize

0 Cookies

6 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

0 Cookies

3 Console Messages

Indicators

fdschjklyhtfdko-ff8s7knj3m252248.codeanyapp.com Open in urlscan Pro
198.199.109.95 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

0 %
IPv6

5
Domains

6
Subdomains

6
IPs

2
Countries

452 kB
Transfer

1001 kB
Size

0
Cookies

11 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!