login.biolabtech.co.ua Open in urlscan Pro
185.156.201.68  Malicious Activity! Public Scan

URL: https://login.biolabtech.co.ua/
Submission: On October 04 via automatic, source certstream-suspicious — Scanned from DE

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 6 HTTP transactions. The main IP is 185.156.201.68, located in Belize and belongs to AMBER-AS ---CLIENTS---, BZ. The main domain is login.biolabtech.co.ua.
TLS certificate: Issued by R3 on October 4th 2021. Valid for: 3 months.
This is the only time login.biolabtech.co.ua was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Okta (Online)

Domain & IP information

IP Address AS Autonomous System
6 185.156.201.68 56388 (AMBER-AS ...)
6 2
Apex Domain
Subdomains
Transfer
6 co.ua
login.biolabtech.co.ua
381 KB
6 1
Domain Requested by
6 login.biolabtech.co.ua login.biolabtech.co.ua
6 1

This site contains links to these domains. Also see Links.

Domain
support.biolabtech.co.ua
www.biolabtech.co.ua
Subject Issuer Validity Valid
login.biolabtech.co.ua
R3
2021-10-04 -
2022-01-02
3 months crt.sh

This page contains 2 frames:

Primary Page: https://login.biolabtech.co.ua/
Frame ID: 334672DD5DD97AA72CCDF1E6187C1F66
Requests: 5 HTTP requests in this frame

Frame: https://login.biolabtech.co.ua/discovery/iframe.html
Frame ID: 4B7FD2CB7D68E940FAE74AB0065A2FF7
Requests: 2 HTTP requests in this frame

Screenshot

Page Title

Okta Account Chooser

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

381 kB
Transfer

379 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
login.biolabtech.co.ua/
6 KB
6 KB
Document
General
Full URL
https://login.biolabtech.co.ua/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
185.156.201.68 , Belize, ASN56388 (AMBER-AS ---CLIENTS---, BZ),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2ae5e48d286558f234317e9b570f81199f6cefee9ae6e7ef5afb5fc4dc8103b7

Request headers

Host
login.biolabtech.co.ua
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Age
4549
Connection
close
Content-Type
text/html
Date
Mon, 04 Oct 2021 14:37:42 GMT
Etag
"1f75d7ad991d965c80af28e339a93613"
Last-Modified
Wed, 29 Sep 2021 19:55:56 GMT
Server
AmazonS3
Transfer-Encoding
chunked
Via
1.1 0d37b2e69745cd9f0c5457fbf1a83129.cloudfront.net (CloudFront)
X-Amz-Cf-Id
mVzk-jW2bd38fKYXLNBlkFs3wzgseEMm3bY3vwpZHHDzpsS4jB3gpw==
X-Amz-Cf-Pop
FRA50-C1
X-Cache
Hit from cloudfront
X-Edge-Origin-Shield-Skipped
0
okta-sign-in.css
login.biolabtech.co.ua/css/
19 KB
19 KB
Stylesheet
General
Full URL
https://login.biolabtech.co.ua/css/okta-sign-in.css?5c477f547ca388df273c
Requested by
Host: login.biolabtech.co.ua
URL: https://login.biolabtech.co.ua/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
185.156.201.68 , Belize, ASN56388 (AMBER-AS ---CLIENTS---, BZ),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5572875b12773054867e1462c592b5b3de2c88bf7cff7f7fc9174ce78b8a4065

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
login.biolabtech.co.ua
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
text/css,*/*;q=0.1
Cache-Control
no-cache
Sec-Fetch-Dest
style
Referer
https://login.biolabtech.co.ua/
Connection
keep-alive
Accept-Language
de-DE,de;q=0.9
Referer
https://login.biolabtech.co.ua/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Sun, 03 Oct 2021 20:01:28 GMT
Via
1.1 0d37b2e69745cd9f0c5457fbf1a83129.cloudfront.net (CloudFront)
Connection
close
Last-Modified
Wed, 29 Sep 2021 19:55:55 GMT
Server
AmazonS3
Age
71523
Etag
"3e36eebd488929e36d33e2b6a0340b84"
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Content-Type
text/css
X-Edge-Origin-Shield-Skipped
0
X-Amz-Cf-Pop
FRA50-C1
X-Amz-Cf-Id
W_WbuaYtb0UBnsT678c2U-DimMi8rT5izdw6G77QkDN0y8g8pTVywQ==
myOkta-caa9e875e587f9c0d140.min.js
login.biolabtech.co.ua/lib/
255 KB
255 KB
Script
General
Full URL
https://login.biolabtech.co.ua/lib/myOkta-caa9e875e587f9c0d140.min.js
Requested by
Host: login.biolabtech.co.ua
URL: https://login.biolabtech.co.ua/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
185.156.201.68 , Belize, ASN56388 (AMBER-AS ---CLIENTS---, BZ),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9b4067c29044689f7eae41d950e8d25d3ae622b65e854a5d3e2a94ac64b1abd0

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
login.biolabtech.co.ua
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://login.biolabtech.co.ua/
Connection
keep-alive
Accept-Language
de-DE,de;q=0.9
Referer
https://login.biolabtech.co.ua/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Mon, 04 Oct 2021 02:30:18 GMT
Via
1.1 0d37b2e69745cd9f0c5457fbf1a83129.cloudfront.net (CloudFront)
Connection
close
Last-Modified
Wed, 29 Sep 2021 19:55:56 GMT
Server
AmazonS3
Age
48193
Etag
"dcbfb6d64fa97d542de46ac5a3d96ea5"
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Content-Type
application/javascript
X-Edge-Origin-Shield-Skipped
0
X-Amz-Cf-Pop
FRA50-C1
X-Amz-Cf-Id
Oh9qYFeffKy69GvrzAoqdWoDX54iEOtdCnDd9LwTdG5kiYsv5JbWGQ==
logo_okta.png
login.biolabtech.co.ua/img/
2 KB
3 KB
Image
General
Full URL
https://login.biolabtech.co.ua/img/logo_okta.png
Requested by
Host: login.biolabtech.co.ua
URL: https://login.biolabtech.co.ua/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
185.156.201.68 , Belize, ASN56388 (AMBER-AS ---CLIENTS---, BZ),
Reverse DNS
Software
AmazonS3 /
Resource Hash
07561b0527818d05bb073cae9d055895924a96bcea0721ac7a0dcb3c3f708af0

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
login.biolabtech.co.ua
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control
no-cache
Sec-Fetch-Dest
image
Referer
https://login.biolabtech.co.ua/
Connection
keep-alive
Accept-Language
de-DE,de;q=0.9
Referer
https://login.biolabtech.co.ua/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Sun, 03 Oct 2021 20:02:14 GMT
Via
1.1 0d37b2e69745cd9f0c5457fbf1a83129.cloudfront.net (CloudFront)
Connection
close
Last-Modified
Wed, 29 Sep 2021 19:55:56 GMT
Server
AmazonS3
Age
71478
Etag
"00b28e552573899e15fa6e77278759d5"
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Content-Type
image/png
X-Edge-Origin-Shield-Skipped
0
X-Amz-Cf-Pop
FRA50-C1
X-Amz-Cf-Id
_PvpdDhV4Nvw40pw7P6fR-El0gaOiVrGODMFyK6V68Sq7kEo2XZj2g==
iframe.html
login.biolabtech.co.ua/discovery/ Frame 4B7F
546 B
1 KB
Document
General
Full URL
https://login.biolabtech.co.ua/discovery/iframe.html
Requested by
Host: login.biolabtech.co.ua
URL: https://login.biolabtech.co.ua/lib/myOkta-caa9e875e587f9c0d140.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
185.156.201.68 , Belize, ASN56388 (AMBER-AS ---CLIENTS---, BZ),
Reverse DNS
Software
AmazonS3 /
Resource Hash
423d21e324a5edcac80a5781928ee5b867a155517971311afa223fa5a6402f62

Request headers

Host
login.biolabtech.co.ua
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
same-origin
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://login.biolabtech.co.ua/
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://login.biolabtech.co.ua/

Response headers

Age
71849
Connection
close
Content-Type
text/html
Date
Sun, 03 Oct 2021 19:56:03 GMT
Etag
"ca9c41472748cb3bed93e1d9d8d512e6"
Last-Modified
Wed, 29 Sep 2021 19:55:55 GMT
Server
AmazonS3
Transfer-Encoding
chunked
Via
1.1 0d37b2e69745cd9f0c5457fbf1a83129.cloudfront.net (CloudFront)
X-Amz-Cf-Id
_qTm5-sWIpJSRkj87O_sJdFdMzgprlLih5OxvTaMZYTXnUdcRVASKg==
X-Amz-Cf-Pop
FRA50-C1
X-Cache
Hit from cloudfront
X-Edge-Origin-Shield-Skipped
0
discoveryIframe-b506e7d77d3be273b646.min.js
login.biolabtech.co.ua/lib/ Frame 4B7F
96 KB
96 KB
Script
General
Full URL
https://login.biolabtech.co.ua/lib/discoveryIframe-b506e7d77d3be273b646.min.js
Requested by
Host: login.biolabtech.co.ua
URL: https://login.biolabtech.co.ua/discovery/iframe.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
185.156.201.68 , Belize, ASN56388 (AMBER-AS ---CLIENTS---, BZ),
Reverse DNS
Software
AmazonS3 /
Resource Hash
cbae203941cd3affa65e28723918e385d2cd719aafb0e013b3c9a10ca074c769

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
login.biolabtech.co.ua
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://login.biolabtech.co.ua/discovery/iframe.html
Connection
keep-alive
Accept-Language
de-DE,de;q=0.9
Referer
https://login.biolabtech.co.ua/discovery/iframe.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Sun, 03 Oct 2021 16:25:18 GMT
Via
1.1 0d37b2e69745cd9f0c5457fbf1a83129.cloudfront.net (CloudFront)
Connection
close
Last-Modified
Wed, 29 Sep 2021 19:55:56 GMT
Server
AmazonS3
Age
84494
Etag
"4f89e5457171bb31ae15366366a55d19"
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Content-Type
application/javascript
X-Edge-Origin-Shield-Skipped
0
X-Amz-Cf-Pop
FRA50-C1
X-Amz-Cf-Id
cBFtFCdmrhCBwCu_DPIHgitrlOZv-rwzpo5ZwltuEgslK63zs1Il2Q==
truncated
/
877 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
95915f8e958a3cb8004c554e0ce6af472fbfb95434d026b45eb72a3801f3e0a8

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type
image/svg+xml

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Okta (Online)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforexrselect boolean| originAgentCluster function| myOkta object| __core-js_shared__ object| core object| global object| System function| asap function| Observable function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill

0 Cookies