mj7x.com Open in urlscan Pro
156.254.71.180 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://mj7x.com/news/wp-content/plugins/soo/m-login.php?id=c1844a0bc429a7e69dc9ce6fc40a7708f7a6245f6e6c838598250...
Submission: On August 12 via api (August 12th 2020, 12:31:09 pm UTC) from QA

Summary HTTP 15 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 15 HTTP transactions. The main IP is 156.254.71.180, located in Johannesburg, South Africa and belongs to SKHT-AS Shenzhen Katherine Heng Technology Information Co., Ltd., CN. The main domain is mj7x.com.

This is the only time mj7x.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BT (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
1	156.254.71.180 156.254.71.180	135357 (SKHT-AS S...) (SKHT-AS Shenzhen Katherine Heng Technology Information Co.)
14	68.142.68.29 68.142.68.29	22822 (LLNW) (LLNW)
15	3

1 156.254.71.180 (Johannesburg, South Africa)

ASN135357 (SKHT-AS Shenzhen Katherine Heng Technology Information Co., Ltd., CN)

mj7x.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 68.142.68.29 (United States)

ASN22822 (LLNW, US)
PTR: https-68-142-68-29.any.llnw.net

img01.bt.co.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
home.bt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	bt.co.uk img01.bt.co.uk	156 KB
1	bt.com home.bt.com	2 KB
1	mj7x.com mj7x.com	4 KB
15	3

	Domain	Requested by
13	img01.bt.co.uk	mj7x.com
1	home.bt.com	mj7x.com
1	mj7x.com
15	3

This site contains no links.

Subject Issuer	Validity	Valid
www.bt.com DigiCert SHA2 Extended Validation Server CA	`2019-10-14` - `2020-10-13`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://mj7x.com/news/wp-content/plugins/soo/m-login.php?id=c1844a0bc429a7e69dc9ce6fc40a7708f7a6245f6e6c838598250ad63333eeb4f89cd3950d7d403cc7635e4afff2c9202cc474e03ffd50a7affdc93e
Frame ID: 77A90624363749F6B5F25655EF684371
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

15
Requests

87 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

203 kB
Transfer

624 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set m-login.php Show response
mj7x.com/news/wp-content/plugins/soo/ 9 KB
4 KB 640ms
618ms Document
text/html 156.254.71.180
SKHT-AS Shenzhen ...

General

Check archive.org

Show headers Download Go to

Full URL: http://mj7x.com/news/wp-content/plugins/soo/m-login.php?id=c1844a0bc429a7e69dc9ce6fc40a7708f7a6245f6e6c838598250ad63333eeb4f89cd3950d7d403cc7635e4afff2c9202cc474e03ffd50a7affdc93e
Protocol: HTTP/1.1
Server: 156.254.71.180 Johannesburg, South Africa, ASN135357 (SKHT-AS Shenzhen Katherine Heng Technology Information Co., Ltd., CN),
Reverse DNS
Software: nginx /
Resource Hash: 7d07871057d85653214fe44050af27bac0997d3ed973960b93b309dc4dd8d8ef

Request headers

Host: mj7x.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server: nginx
Date: Wed, 12 Aug 2020 12:30:49 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Set-Cookie: PHPSESSID=2rrqm0l5vds49b8gvoc5i600n3; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Encoding: gzip

GET
H/1.1 200
OK login-datalayer.js Show response
img01.bt.co.uk/s/assets/260320/js/ 710 B
897 B 1634ms
65ms Script
application/javascript 68.142.68.29
LLNW

General

Check archive.org

Show headers Download Go to

Full URL

http://img01.bt.co.uk/s/assets/260320/js/login-datalayer.js

Requested by

Host: mj7x.com
URL: http://mj7x.com/news/wp-content/plugins/soo/m-login.php?id=c1844a0bc429a7e69dc9ce6fc40a7708f7a6245f6e6c838598250ad63333eeb4f89cd3950d7d403cc7635e4afff2c9202cc474e03ffd50a7affdc93e

Protocol

HTTP/1.1

Server

68.142.68.29 , United States, ASN22822 (LLNW, US),

Reverse DNS

https-68-142-68-29.any.llnw.net

Software

Resource Hash

c8f47c528c93a4dc7104388ee8d7e5fd2e67efd2cc641116825f4d539198cd2a

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://mj7x.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 12 Aug 2020 12:30:51 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Age: 72497
X-btsite: 1
Connection: keep-alive
Content-Length: 418
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=Edge
Last-Modified: Mon, 22 Jun 2020 20:05:59 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
Cache-Control: max-age=86400
Accept-Ranges: bytes
X-LLID: ef566c6b3427572b23980c588bf64757
Expires: Wed, 12 Aug 2020 16:22:34 GMT

GET
H/1.1 200
OK common-reset.css
img01.bt.co.uk/s/assets/260320/css/ 65 KB
35 KB 1683ms
47ms Stylesheet
text/css 68.142.68.29
LLNW

General

Check archive.org

Show headers Download Go to

Full URL

https://img01.bt.co.uk/s/assets/260320/css/common-reset.css

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

68.142.68.29 , United States, ASN22822 (LLNW, US),

Reverse DNS

https-68-142-68-29.any.llnw.net

Software

Resource Hash

d4a986c22ae001e743c50f59d647eabba306e35899b7aec56992e37833bd7015

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://mj7x.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 12 Aug 2020 12:30:51 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Mon, 22 Jun 2020 20:05:59 GMT
Age: 86
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
X-btsite: 1
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=86400
X-UA-Compatible: IE=Edge
Connection: keep-alive
Content-Length: 35373
X-LLID: f6df6843de5817c12ebe4380ef51dc88
Expires: Thu, 13 Aug 2020 12:29:25 GMT

GET
H/1.1 200
OK common.css
img01.bt.co.uk/s/assets/260320/css/ 181 KB
34 KB 1699ms
64ms Stylesheet
text/css 68.142.68.29
LLNW

General

Check archive.org

Show headers Download Go to

Full URL

https://img01.bt.co.uk/s/assets/260320/css/common.css

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

68.142.68.29 , United States, ASN22822 (LLNW, US),

Reverse DNS

https-68-142-68-29.any.llnw.net

Software

Resource Hash

c5f82b0a249afe838c24e127133a8706da913f49cd63a6e58629b7aabda6c3d6

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://mj7x.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 12 Aug 2020 12:30:51 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Mon, 22 Jun 2020 20:05:59 GMT
Age: 78894
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
X-btsite: 1
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=86400
X-UA-Compatible: IE=Edge
Connection: keep-alive
Content-Length: 34678
X-LLID: d6852d47726550eba340b6bd201304b7
Expires: Wed, 12 Aug 2020 14:35:57 GMT

GET
H/1.1 200
OK index.css
img01.bt.co.uk/s/assets/260320/aauth/css/ 125 KB
20 KB 1700ms
64ms Stylesheet
text/css 68.142.68.29
LLNW

General

Check archive.org

Show headers Download Go to

Full URL

https://img01.bt.co.uk/s/assets/260320/aauth/css/index.css

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

68.142.68.29 , United States, ASN22822 (LLNW, US),

Reverse DNS

https-68-142-68-29.any.llnw.net

Software

Resource Hash

e3f7a58fe67b04d01e049ca1cd6604b939cd660eb2df6a2d7fa3fca4c01676b0

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://mj7x.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 12 Aug 2020 12:30:51 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Mon, 22 Jun 2020 20:05:59 GMT
Age: 86
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
X-btsite: 1
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=86400
X-UA-Compatible: IE=Edge
Connection: keep-alive
Content-Length: 20406
X-LLID: d838d245cbd00cfd260f38ff02da8618
Expires: Thu, 13 Aug 2020 12:29:25 GMT

GET
H/1.1 200
OK bts-common.css
img01.bt.co.uk/s/assets/260320/css/ 88 KB
13 KB 1700ms
54ms Stylesheet
text/css 68.142.68.29
LLNW

General

Check archive.org

Show headers Download Go to

Full URL

https://img01.bt.co.uk/s/assets/260320/css/bts-common.css

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

68.142.68.29 , United States, ASN22822 (LLNW, US),

Reverse DNS

https-68-142-68-29.any.llnw.net

Software

Resource Hash

7deb5405a84486905b040b40d17438fbdfe40db3e1fff910992758e27dc59d43

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://mj7x.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 12 Aug 2020 12:30:51 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Mon, 22 Jun 2020 20:05:59 GMT
Age: 78894
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
X-btsite: 1
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=86400
X-UA-Compatible: IE=Edge
Connection: keep-alive
Content-Length: 12866
X-LLID: b9aebd8022249fbe68b94f8831e9e685
Expires: Wed, 12 Aug 2020 14:35:57 GMT

GET
H/1.1 200
OK login-index.css
img01.bt.co.uk/s/assets/260320/css/ 76 KB
14 KB 1701ms
54ms Stylesheet
text/css 68.142.68.29
LLNW

General

Check archive.org

Show headers Download Go to

Full URL

https://img01.bt.co.uk/s/assets/260320/css/login-index.css

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

68.142.68.29 , United States, ASN22822 (LLNW, US),

Reverse DNS

https-68-142-68-29.any.llnw.net

Software

Resource Hash

32f9b445cdf66b5aa8fc260f589ec18984fbe2042fd319c5693c8054c6378de8

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://mj7x.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 12 Aug 2020 12:30:51 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Mon, 22 Jun 2020 20:05:59 GMT
Age: 77755
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
X-btsite: 1
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=86400
X-UA-Compatible: IE=Edge
Connection: keep-alive
Content-Length: 13465
X-LLID: 74bdc209f4dc67180e2f51b0617daf57
Expires: Wed, 12 Aug 2020 14:54:56 GMT

GET
H/1.1 200
OK rebrand-bt-logo-login-page-136440342141502601-191112130458.png
home.bt.com/images/ 2 KB
2 KB 1697ms
45ms Image
image/png 68.142.68.29
LLNW

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://home.bt.com/images/rebrand-bt-logo-login-page-136440342141502601-191112130458.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

68.142.68.29 , United States, ASN22822 (LLNW, US),

Reverse DNS

https-68-142-68-29.any.llnw.net

Software

Resource Hash

670d9073ccec70934db12cf5580205e55d8e2613e7b51a632736abb72bf8eb42

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://mj7x.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 12 Aug 2020 12:30:53 GMT
Last-Modified: Wed, 12 Aug 2020 12:29:25 GMT
X-XSS-Protection: 1; mode=block
Age: 88
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
X-btsite: 2
Expires: Thu, 13 Aug 2020 12:29:25 GMT
Cache-Control: max-age=86400
X-UA-Compatible: IE=Edge
Connection: keep-alive
Content-Length: 1720
X-LLID: e29a0a4943f5a0374ca1a1c72e1f8a83
mdt-type: abinary; charset=UTF-8

GET
H/1.1 200
OK error.png
img01.bt.co.uk/s/assets/260320/images/ 2 KB
2 KB 44ms
44ms Image
image/png 68.142.68.29
LLNW

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img01.bt.co.uk/s/assets/260320/images/error.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

68.142.68.29 , United States, ASN22822 (LLNW, US),

Reverse DNS

https-68-142-68-29.any.llnw.net

Software

Resource Hash

12f8e6f2951f94dcf7e830cd7dcf8eabcd4f11b87a39e0c8150661ab0b032064

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://img01.bt.co.uk/s/assets/260320/css/common.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 12 Aug 2020 12:30:51 GMT
Last-Modified: Mon, 22 Jun 2020 20:05:59 GMT
Age: 78889
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
X-btsite: 1
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=86400
X-UA-Compatible: IE=Edge
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2087
X-LLID: 8f1f777bcd9186b3706491bd4deb7d11
Expires: Wed, 12 Aug 2020 14:36:02 GMT

GET
H/1.1 200
OK logintextboxbg.png
img01.bt.co.uk/s/assets/260320/images/ 966 B
1 KB 44ms
44ms Image
image/png 68.142.68.29
LLNW

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img01.bt.co.uk/s/assets/260320/images/logintextboxbg.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

68.142.68.29 , United States, ASN22822 (LLNW, US),

Reverse DNS

https-68-142-68-29.any.llnw.net

Software

Resource Hash

2b1930ba4a2e3f401d744fc3d55c2464a79736bfbc0f0875d98dca864b16449f

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://img01.bt.co.uk/s/assets/260320/css/login-index.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 12 Aug 2020 12:30:51 GMT
Last-Modified: Mon, 22 Jun 2020 20:05:59 GMT
Age: 78889
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
X-btsite: 1
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=86400
X-UA-Compatible: IE=Edge
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 966
X-LLID: 5dc9299768395e746e74f25e761c7ea4
Expires: Wed, 12 Aug 2020 14:36:02 GMT

GET
DATA 200
OK truncated
/ 42 KB
42 KB Font
font/truetype

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 91d32af051d9ace7282b43d300b85debad94fa8659ee69f3e7616e4e1a7605e2

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: http://mj7x.com

Response headers

Content-Type: font/truetype;charset=utf-8

GET
H/1.1 200
OK icons-sprite-8bit.png
img01.bt.co.uk/s/assets/260320/images/ 5 KB
5 KB 52ms
51ms Image
image/png 68.142.68.29
LLNW

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img01.bt.co.uk/s/assets/260320/images/icons-sprite-8bit.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

68.142.68.29 , United States, ASN22822 (LLNW, US),

Reverse DNS

https-68-142-68-29.any.llnw.net

Software

Resource Hash

6c15da6e07c5e0c79941d5f3e5e5839e1b1d87d3f03badceb337e88bbe78609f

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://img01.bt.co.uk/s/assets/260320/css/common.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 12 Aug 2020 12:30:51 GMT
Last-Modified: Mon, 22 Jun 2020 20:05:59 GMT
Age: 77754
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
X-btsite: 1
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=86400
X-UA-Compatible: IE=Edge
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 5100
X-LLID: 944db7190e8918a29f2e755f446bd44d
Expires: Wed, 12 Aug 2020 14:54:57 GMT

GET
H/1.1 200
OK LoginButtonBg.png
img01.bt.co.uk/s/assets/260320/images/ 211 B
608 B 50ms
50ms Image
image/png 68.142.68.29
LLNW

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img01.bt.co.uk/s/assets/260320/images/LoginButtonBg.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

68.142.68.29 , United States, ASN22822 (LLNW, US),

Reverse DNS

https-68-142-68-29.any.llnw.net

Software

Resource Hash

7583bdd341399e600785dab65ac725a95dced3b0054ed8ca9b8d69fbde04def8

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://img01.bt.co.uk/s/assets/260320/css/common.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 12 Aug 2020 12:30:51 GMT
Last-Modified: Mon, 22 Jun 2020 20:05:59 GMT
Age: 78889
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
X-btsite: 1
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=86400
X-UA-Compatible: IE=Edge
Connection: keep-alive
Content-Length: 211
X-LLID: d1f1b9db8d47108c71751a6d41f6c05f
Expires: Wed, 12 Aug 2020 14:36:02 GMT

GET
H/1.1 200
OK login-back.png
img01.bt.co.uk/s/assets/260320/images/ 279 B
698 B 44ms
44ms Image
image/png 68.142.68.29
LLNW

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img01.bt.co.uk/s/assets/260320/images/login-back.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

68.142.68.29 , United States, ASN22822 (LLNW, US),

Reverse DNS

https-68-142-68-29.any.llnw.net

Software

Resource Hash

6de9b19d62ae2029b5d7c51c7eb8fcbdee6503abf32cd74fa3963c76490bc0ac

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://img01.bt.co.uk/s/assets/260320/css/common.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 12 Aug 2020 12:30:51 GMT
Last-Modified: Mon, 22 Jun 2020 20:05:59 GMT
Age: 78889
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
X-btsite: 1
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=86400
X-UA-Compatible: IE=Edge
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 279
X-LLID: 20103c8e82b9eb681c4e9023c0cad6a2
Expires: Wed, 12 Aug 2020 14:36:02 GMT

GET
H/1.1 200
OK bttv_rg-webfont.woff
img01.bt.co.uk/s/assets/260320/aauth/css/fonts/ 26 KB
26 KB 153ms
64ms Font
application/x-font-woff 68.142.68.29
LLNW

General

Check archive.org

Show headers Download Go to

Full URL

https://img01.bt.co.uk/s/assets/260320/aauth/css/fonts/bttv_rg-webfont.woff

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

68.142.68.29 , United States, ASN22822 (LLNW, US),

Reverse DNS

https-68-142-68-29.any.llnw.net

Software

Resource Hash

1313323817898228d6399b6de26686f15af3bfc9ebda293cc7656e27611673f9

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://img01.bt.co.uk/s/assets/260320/aauth/css/index.css
Origin: http://mj7x.com

Response headers

Date: Wed, 12 Aug 2020 12:30:51 GMT
Last-Modified: Mon, 22 Jun 2020 20:05:59 GMT
Age: 78889
X-Frame-Options: SAMEORIGIN
Content-Type: application/x-font-woff
Access-Control-Allow-Origin: *
X-btsite: 1
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=86400
X-UA-Compatible: IE=Edge
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 26600
X-LLID: 83a88521e9cd57d6a66dc1eb5d48ada9
Expires: Wed, 12 Aug 2020 14:36:02 GMT

GET
H/1.1 200
OK bt-footer-bg.jpg
img01.bt.co.uk/s/assets/260320/images/ 1 KB
2 KB 44ms
44ms Image
image/jpeg 68.142.68.29
LLNW

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img01.bt.co.uk/s/assets/260320/images/bt-footer-bg.jpg

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

68.142.68.29 , United States, ASN22822 (LLNW, US),

Reverse DNS

https-68-142-68-29.any.llnw.net

Software

Resource Hash

cbf86fc1cedf23b294f4610fe0140df33f350071028953d6cc1c2c4249851038

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://img01.bt.co.uk/s/assets/260320/css/common-reset.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 12 Aug 2020 12:30:51 GMT
Last-Modified: Mon, 22 Jun 2020 20:05:59 GMT
Age: 78889
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
X-btsite: 1
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=86400
X-UA-Compatible: IE=Edge
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1251
X-LLID: 613267cb8b4870e001bfcde926ce352e
Expires: Wed, 12 Aug 2020 14:36:02 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BT (Telecommunication)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

home.bt.com
img01.bt.co.uk
mj7x.com
156.254.71.180
68.142.68.29
12f8e6f2951f94dcf7e830cd7dcf8eabcd4f11b87a39e0c8150661ab0b032064
1313323817898228d6399b6de26686f15af3bfc9ebda293cc7656e27611673f9
2b1930ba4a2e3f401d744fc3d55c2464a79736bfbc0f0875d98dca864b16449f
32f9b445cdf66b5aa8fc260f589ec18984fbe2042fd319c5693c8054c6378de8
670d9073ccec70934db12cf5580205e55d8e2613e7b51a632736abb72bf8eb42
6c15da6e07c5e0c79941d5f3e5e5839e1b1d87d3f03badceb337e88bbe78609f
6de9b19d62ae2029b5d7c51c7eb8fcbdee6503abf32cd74fa3963c76490bc0ac
7583bdd341399e600785dab65ac725a95dced3b0054ed8ca9b8d69fbde04def8
7d07871057d85653214fe44050af27bac0997d3ed973960b93b309dc4dd8d8ef
7deb5405a84486905b040b40d17438fbdfe40db3e1fff910992758e27dc59d43
91d32af051d9ace7282b43d300b85debad94fa8659ee69f3e7616e4e1a7605e2
c5f82b0a249afe838c24e127133a8706da913f49cd63a6e58629b7aabda6c3d6
c8f47c528c93a4dc7104388ee8d7e5fd2e67efd2cc641116825f4d539198cd2a
cbf86fc1cedf23b294f4610fe0140df33f350071028953d6cc1c2c4249851038
d4a986c22ae001e743c50f59d647eabba306e35899b7aec56992e37833bd7015
e3f7a58fe67b04d01e049ca1cd6604b939cd660eb2df6a2d7fa3fca4c01676b0

mj7x.com Open in urlscan Pro 156.254.71.180 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

15 Requests

87 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

203 kBTransfer

624 kBSize

0 Cookies

0 Outgoing links

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

0 Cookies

Indicators

mj7x.com Open in urlscan Pro
156.254.71.180 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

87 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

203 kB
Transfer

624 kB
Size

0
Cookies

15 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!