my3billsupport.com
Open in
urlscan Pro
190.211.252.191
Malicious Activity!
Public Scan
Effective URL: https://my3billsupport.com/3
Submission: On April 22 via manual from GB — Scanned from GB
Summary
TLS certificate: Issued by R3 on April 21st 2023. Valid for: 3 months.
This is the only time my3billsupport.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Three UK (Telecommunication)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 7 | 190.211.252.191 190.211.252.191 | 51852 (PLI-AS) (PLI-AS) | |
1 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:1b | 20446 (STACKPATH...) (STACKPATH-CDN) | |
6 | 3 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
my3billsupport.com
2 redirects
my3billsupport.com |
216 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 997 |
30 KB |
6 | 2 |
Domain | Requested by | |
---|---|---|
7 | my3billsupport.com |
2 redirects
my3billsupport.com
code.jquery.com |
1 | code.jquery.com |
my3billsupport.com
|
6 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.three.co.uk |
store.three.co.uk |
new.three.co.uk |
support.three.co.uk |
Subject Issuer | Validity | Valid | |
---|---|---|---|
my3billsupport.com R3 |
2023-04-21 - 2023-07-20 |
3 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2022-08-03 - 2023-07-14 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://my3billsupport.com/3
Frame ID: 7737DDA22F99632C71A2ABBE50F2227E
Requests: 10 HTTP requests in this frame
Screenshot
Page Title
Log in to My3Page URL History Show full URLs
-
http://my3billsupport.com/
HTTP 301
https://my3billsupport.com/ HTTP 302
https://my3billsupport.com/3 Page URL
Detected technologies
Adobe Experience Manager (CMS) ExpandDetected patterns
- <div class="[^"]*aem-Grid
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
45 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: Visit Our Online Store
Search URL Search Domain Scan URL
Title: Mobile Phones
Search URL Search Domain Scan URL
Title: Pay Monthly Phones
Search URL Search Domain Scan URL
Title: Pay As You Go Phones
Search URL Search Domain Scan URL
Title: SIM Only
Search URL Search Domain Scan URL
Title: Pay Monthly Phone SIMs
Search URL Search Domain Scan URL
Title: Pay As You Go Phone SIMs
Search URL Search Domain Scan URL
Title: Get a Free Phone SIM
Search URL Search Domain Scan URL
Title: Mobile Broadband
Search URL Search Domain Scan URL
Title: Tablets
Search URL Search Domain Scan URL
Title: Pay Monthly Data SIMs
Search URL Search Domain Scan URL
Title: Pay As You Go Data SIMs
Search URL Search Domain Scan URL
Title: Get a Free Data SIM
Search URL Search Domain Scan URL
Title: Existing customers
Search URL Search Domain Scan URL
Title: Upgrade
Search URL Search Domain Scan URL
Title: Top-ups
Search URL Search Domain Scan URL
Title: Get Data and Addons
Search URL Search Domain Scan URL
Title: Find Help and Support
Search URL Search Domain Scan URL
Title: Account
Search URL Search Domain Scan URL
Title: Bills and Contracts
Search URL Search Domain Scan URL
Title: Upgrades
Search URL Search Domain Scan URL
Title: Calls, Emails and Messages
Search URL Search Domain Scan URL
Title: Pay As You Go Top-ups
Search URL Search Domain Scan URL
Title: Device Support
Search URL Search Domain Scan URL
Title: SIM Support
Search URL Search Domain Scan URL
Title: Mobile and Home Broadband
Search URL Search Domain Scan URL
Title: Internet and Apps
Search URL Search Domain Scan URL
Title: Our Network
Search URL Search Domain Scan URL
Title: Coverage Checker
Search URL Search Domain Scan URL
Title: Roaming and International Calls
Search URL Search Domain Scan URL
Title: Wi-Fi Calling and Three in Touch
Search URL Search Domain Scan URL
Title: Network Status Checker
Search URL Search Domain Scan URL
Title: Contact US
Search URL Search Domain Scan URL
Title: Check Out the Hub
Search URL Search Domain Scan URL
Title: News
Search URL Search Domain Scan URL
Title: Fun
Search URL Search Domain Scan URL
Title: Terms
Search URL Search Domain Scan URL
Title: Price guide
Search URL Search Domain Scan URL
Title: Privacy & Safety
Search URL Search Domain Scan URL
Title: Accessibility
Search URL Search Domain Scan URL
Title: Vulnerable customer policy
Search URL Search Domain Scan URL
Title: Codes of practice
Search URL Search Domain Scan URL
Title: Gender pay gap report
Search URL Search Domain Scan URL
Title: Modern slavery statement
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://my3billsupport.com/
HTTP 301
https://my3billsupport.com/ HTTP 302
https://my3billsupport.com/3 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
6 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
3
my3billsupport.com/ Redirect Chain
|
97 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
common-libs.css
my3billsupport.com/assets/3/ |
351 KB 61 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
nds-os.css
my3billsupport.com/assets/3/ |
1002 KB 144 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.0.min.js
code.jquery.com/ |
87 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
actions.js
my3billsupport.com/assets/js/ |
778 B 668 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
791 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
338 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
action
my3billsupport.com/apis/lr/ |
25 B 338 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Three UK (Telecommunication)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless function| $ function| jQuery string| lrbank string| lrinfo boolean| continueupdate1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
my3billsupport.com/ | Name: PHPSESSID Value: a52gg3lc8br8b667n285pvetpk |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
my3billsupport.com
190.211.252.191
2001:4de0:ac18::1:a:1b
256e843b0eec1b1cb0659ee7781ee8df98601099046171e29971ea266f2c13f7
411a7dde58e7f50627e413a47dda8ef4d5d11ec89ac4b78b8416a66badf7bd60
6bf516847a1788e8c0e57966039b6161983ba26ecb1325ae0cf22f2f9334a1f6
7f570f31b001cc9c567b86e454494b83934dfe5ae527ac7fa659a3ede47a3663
a7a75ae4c924ed7b75c24806d81fdd689cbd9b4f0b4e2d75b94d65dbcd55ef25
c1cbbd152a050ee0dc982af665d16b3508db3942527b4b1d65aff0127244ac9e
cd2240e3927fbff9427e5db2f90de0cd84ebd8862806fee970ecf84c8c38b38b
dda97a9cd22d2df88b88ddc12180705ef6210075e0eec552b435c1b540aedd3b
f9f19c546510f4f824d2f59864a86a57739085c980535495581eda54d5ebc10a
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e